CVE-2023-53750: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-53750 is a memory out-of-bounds read vulnerability in the Linux kernel's pinctrl: freescale subsystem. The flaw occurs when num_configs is 1 and the code incorrectly attempts to access configs[1], which is outside the valid array bounds — a condition detectable by KASAN (Kernel Address Sanitizer). It affects Linux kernel versions starting from the introduction of commit f60c9eac54af28d7b5651fe49944bfd5098550e6 through the 6.3 and 6.4 stable series. The vulnerability was published on December 8, 2025, and carries an estimated CVSS severity of Medium with an EPSS score of 0.024% (Feedly, ENISA EUVD).

The root cause is an off-by-one array access error (CWE-125: Out-of-bounds Read) in the Freescale/NXP pin controller driver within the Linux kernel. When pad wakeup configuration passes num_configs = 1, the driver incorrectly fetches configs[1] instead of limiting access to configs[0], reading one element beyond the allocated array. The fix constrains the access to configs[1] only when num_configs is at least 2. Patches were applied to stable branches targeting kernel versions 6.3.13, 6.4.4, and 6.5 (ENISA EUVD, kernel.org patch 1, kernel.org patch 2).

Exploitation of this vulnerability could result in a kernel crash (denial of service) or unintended disclosure of kernel memory contents due to the out-of-bounds read. The impact is primarily limited to systems using Freescale/NXP SoCs with the affected pin controller driver, which are commonly found in embedded Linux platforms. Confidentiality and availability are the primary concerns; integrity impact is considered low given the read-only nature of the flaw (Feedly, ENISA EUVD).

There is no known public proof-of-concept exploit or evidence of in-the-wild exploitation for CVE-2023-53750. The EPSS score is very low at approximately 0.024%, reflecting minimal exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation would require local access to a system running an affected kernel on Freescale/NXP hardware and the ability to trigger pad wakeup configuration with num_configs = 1 (Feedly).

The Linux kernel maintainers have released patches addressing this vulnerability in stable versions 6.3.13, 6.4.4, and 6.5. Users running affected kernel versions on Freescale/NXP hardware should upgrade to the patched stable releases. SUSE has also issued kernel security advisories incorporating this fix (Linux Security SUSE, ENISA EUVD). No configuration-based workaround is documented; patching is the recommended remediation.