CVE-2023-54025: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54025 is a NULL pointer dereference vulnerability in the Linux kernel's RSI Wi-Fi driver (wifi: rsi) related to improper handling of Wake-on-WLAN (WoWlan) configuration during system shutdown. Specifically, the shutdown hook may call rsi_config_wowlan() even when WoWlan was never configured, resulting in a NULL dereference of hw->wiphy->wowlan_config. The vulnerability was published on December 24, 2025, and affects Linux kernel versions from 5.7 up to the patched stable releases. No official CVSS score has been assigned by NVD at this time; Feedly estimates the severity as Medium with an EPSS score of 0.000240 (Feedly, CVE Record).

The root cause is a missing NULL pointer check in the RSI driver's shutdown hook before invoking rsi_config_wowlan(). When WoWlan is never configured by the user, hw->wiphy->wowlan_config remains NULL; the shutdown path fails to verify this before passing the pointer to rsi_config_wowlan(), which internally asserts (via WARN) that the config is non-NULL. The fix adds guards to check both that wiphy is non-NULL and that wowlan_config is non-NULL before proceeding, and inlines the single-use variable. This is a local, kernel-level issue triggered during system shutdown on hardware using the RSI Wi-Fi chipset driver (Feedly, kernel.org patch).

Exploitation of this vulnerability could cause a kernel warning or NULL pointer dereference during system shutdown on affected Linux systems using RSI Wi-Fi hardware, potentially leading to a kernel panic or system crash (denial of service). The impact is limited to availability — there is no evidence of confidentiality or integrity compromise. The vulnerability is triggered locally during shutdown and does not enable remote code execution or privilege escalation (Feedly).

The fix has been backported to multiple stable Linux kernel branches. Patched versions include 5.10.188, 5.15.121, 6.1.39, 6.3.13, 6.4.4, and 6.5 and later. Users should update their Linux kernel to one of these patched stable releases. As a workaround, configuring WoWlan before shutdown (so wowlan_config is non-NULL) would prevent the NULL dereference, but upgrading the kernel is the recommended solution (Feedly, kernel.org patch).