CVE-2023-53425: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-53425 is a NULL pointer dereference vulnerability in the Linux kernel's MediaTek VPU (Video Processing Unit) media platform driver. The flaw exists in drivers/media/platform/mediatek/vpu/mtk_vpu.c at line 570 within the vpu_load_firmware() function, where a NULL pdev (platform device) pointer is dereferenced without proper validation. It was published on September 18, 2025, and affects multiple Linux kernel stable branches. The vulnerability carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly, NVD).

The root cause is classified as CWE-476 (NULL Pointer Dereference). In vpu_load_firmware(), the code proceeds to dereference the pdev pointer even when it may be NULL, a defect originally flagged by the smatch static analysis tool. The attack vector is local (AV:L), requiring low privileges (PR:L) and no user interaction, meaning a local unprivileged user on an affected system with the MediaTek VPU driver loaded could trigger the condition. Affected kernel version ranges include: up to 4.14.324, 4.15–4.19.292, 4.20–5.4.254, 5.5–5.10.191, 5.11–5.15.127, 5.16–6.1.46, and 6.2–6.4.11 (Feedly, NVD).

Successful exploitation results in a kernel crash or denial of service, with high availability impact and no confidentiality or integrity impact. A local low-privileged attacker could cause the kernel to become unresponsive, disrupting all services running on the affected system. The scope is limited to the affected host; there is no evidence of lateral movement potential or data exposure risk associated with this vulnerability (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024%, reflecting a very low probability of exploitation in the near term. No threat actor attribution has been reported.

Patches have been backported to all affected stable kernel branches. Users should upgrade to the following fixed versions or later: 4.14.324, 4.19.293, 5.4.255, 5.10.192, 5.15.128, 6.1.47, 6.4.12, or 6.5+. Eight separate patch commits are available on kernel.org covering each affected branch (Feedly, NVD). As a secondary measure, restricting local user access and applying the principle of least privilege can reduce exposure on systems where immediate patching is not feasible.