CVE-2023-53856: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-53856 is a NULL pointer dereference vulnerability in the Linux kernel's Device Tree (DT) overlay subsystem (of/overlay). The flaw occurs when of_overlay_fdt_apply() fails due to an unresolved phandle symbol: because of_resolve_phandles() is called before init_overlay_changeset(), the overlay_changeset.cset.entries list remains uninitialized, causing a kernel crash (NULL pointer dereference) in overlay_removal_is_ok() during cleanup. It affects Linux kernel versions from the introduction of the vulnerable code path up to the stable patch releases 5.15.132, 6.1.53, 6.4.16, 6.5.3, and 6.6. The vulnerability was published on December 9, 2025, and carries an estimated CVSS severity of Medium (Red Hat CVE, ENISA EUVD).

The root cause is improper initialization ordering in the Linux kernel's OF (Open Firmware) overlay application path, classified as a NULL pointer dereference (CWE-476). In of_overlay_apply(), of_resolve_phandles() is invoked before init_overlay_changeset(), which means the overlay_changeset.cset.entries linked list is never initialized if phandle resolution fails. When the caller subsequently invokes of_overlay_remove() to clean up the partial state, overlay_removal_is_ok() dereferences the uninitialized list pointer, triggering a kernel panic. The fix moves the of_changeset_init() call to of_overlay_fdt_apply() — where all other early initialization occurs — ensuring the changeset is always initialized before any failure path that requires cleanup (Red Hat CVE, Kernel Git).

Successful exploitation causes a kernel NULL pointer dereference, resulting in a system crash (kernel panic) and denial of service. The vulnerability affects availability of the system; there is no direct evidence of confidentiality or integrity impact. Systems using Device Tree overlays — common in embedded Linux, ARM-based platforms, and systems using of_overlay_fdt_apply() — are at risk of unexpected reboots or hangs when a malformed or symbol-unresolvable overlay is applied (Red Hat CVE).

Apply the upstream Linux kernel patches that move of_changeset_init() to of_overlay_fdt_apply(). Fixed versions include stable releases 5.15.132, 6.1.53, 6.4.16, 6.5.3, and 6.6 (and later). Distribution-specific patches are available from vendors such as Red Hat and SUSE (see SUSE advisories SUSE-2026-0281-1 and SUSE-2026-20876-1). Users on affected kernel versions should update to a patched release as soon as possible; no configuration-based workaround is known (Red Hat CVE, Kernel Git).