CVE-2023-54010: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54010 is a null pointer dereference vulnerability in the Linux kernel's ACPICA (ACPI Component Architecture) subsystem, specifically within the acpi_db_display_objects function. The flaw arises because ACPI_ALLOCATE_ZEROED can return NULL on allocation failure, and the resulting object_info pointer is not checked before use, leading to a potential kernel null pointer dereference. The vulnerability was published on December 24, 2025, and affects Linux kernel versions from the initial commit (1da177e4c3f4) up to the respective fix commits across multiple stable branches. No CVSS score has been assigned by NVD at this time, as the record has not been prioritized for enrichment (Feedly, ENISA EUVD).

The root cause is a missing null-return check after a memory allocation call (ACPI_ALLOCATE_ZEROED) in the acpi_db_display_objects function within the ACPICA subsystem (CWE classification: NULL Pointer Dereference, CWE-476). When the kernel is low on memory or the allocation otherwise fails, object_info is set to NULL; subsequent code that dereferences this pointer without validation triggers a kernel panic or system crash. The fix, referenced by ACPICA commit 0d5f467d6a0ba852ea3aad68663cbcbd43300fd4, adds an explicit null check before the pointer is used. Patches have been backported to multiple stable kernel branches (Feedly, kernel.org patch 5.4.244).

Successful exploitation of this vulnerability can cause a kernel null pointer dereference, resulting in a system crash (kernel panic) and denial of service. Because the vulnerable code path is within the ACPI debug subsystem (acpi_db_display_objects), exploitation typically requires local access or the ability to trigger ACPI debug operations, limiting the scope primarily to availability impact rather than confidentiality or integrity. There is no known evidence of data exfiltration or privilege escalation as a direct consequence of this specific flaw (Feedly).

The fix has been backported to multiple Linux stable kernel branches. Administrators should update to the following patched versions or later: 4.14.316, 4.19.284, 5.4.244, 5.10.181, 5.15.113, 6.1.30, 6.3.4, and 6.4+. The corresponding fix commits are available on kernel.org for each stable branch. No configuration-based workaround is documented; upgrading to a patched kernel version is the recommended remediation (Feedly, ENISA EUVD).