CVE-2023-53326: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-53326 is a NULL pointer dereference vulnerability (CWE-476) in the Linux kernel's PowerPC architecture, specifically in the ppr_get()/ppr_set() functions that handle the Processor Priority Register (PPR). The flaw is triggered when a PF_IO_WORKER task (which is initialized with a NULL pt_regs pointer on PowerPC) causes a core dump to be generated, leading to a kernel crash. Affected kernel versions include 4.8 through 5.10.177, 5.11 through 5.15.106, 5.16 through 6.1.23, 6.2 through 6.2.10, and 6.3-rc1 through 6.3-rc4. It was publicly disclosed on September 16, 2025, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a missing NULL check in the ppr_get() and ppr_set() functions within the PowerPC-specific kernel code (CWE-476: NULL Pointer Dereference). On PowerPC, tasks flagged as PF_KTHREAD or PF_IO_WORKER are set up with a NULL pt_regs pointer — a design choice not common to other architectures. When such a PF_IO_WORKER task triggers a core dump (e.g., via elf_core_dump → __regset_get → ppr_get), the kernel attempts to copy PPR data from the NULL pt_regs, resulting in a kernel NULL pointer dereference at address 0x00000160. The fix adds a validity check for pt_regs in both ppr_get and ppr_set, returning -EINVAL if the pointer is NULL (Red Hat Bugzilla, Kernel Patches).

Successful exploitation causes a kernel panic (system crash), resulting in a denial of service (DoS) on the affected PowerPC system. There is no impact on confidentiality or integrity — the vulnerability is limited to availability. The crash affects the entire system, not just a single process, meaning all services running on the host would be disrupted (Red Hat Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability requires local access with low privileges to trigger, and is architecture-specific (PowerPC only), significantly limiting its attack surface. The EPSS score is 0.018% (0.000180), reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Red Hat Advisory).

• Logs: Kernel log entries containing BUG: Kernel NULL pointer dereference on read at 0x00000160 or Kernel attempted to read user page (160) - exploit attempt? on PowerPC systems.
• Logs: Kernel oops traces referencing the call chain ppr_get → __regset_get → regset_get_alloc → elf_core_dump → do_coredump.
• System Behavior: Unexpected system reboots or kernel panics on PowerPC hosts, particularly when PF_IO_WORKER tasks are active and a process generates a core dump.

Apply the upstream kernel patches available for the affected stable branches: fixes are available in kernel versions 5.10.177+, 5.15.106+, 6.1.23+, 6.2.10+, and 6.3-rc5+ (Kernel Patches, Kernel Patches). As a temporary workaround, limiting local user access on PowerPC systems reduces the risk of a low-privileged user triggering the crash. Organizations running Red Hat-based distributions on PowerPC should monitor the Red Hat Bugzilla entry for distribution-specific package updates (Red Hat Bugzilla).