CVE-2023-54027: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54027 is a NULL pointer dereference vulnerability in the Linux kernel's IIO (Industrial I/O) subsystem that can cause a kernel crash when a device has no parent. The flaw was introduced by commit 813665564b3d ("iio: core: Convert to use firmware node handle instead of OF node"), which inadvertently caused a NULL pointer to be accessed in __iio_device_register when the parent device is NULL. It is reproducible using the stock IIO dummy driver via configfs (e.g., mkdir /sys/kernel/config/iio/devices/dummy/foo). The vulnerability was published on December 24, 2025, and is estimated as Medium severity with an EPSS score of 0.000170 (Feedly, CVE.org).

The root cause is a NULL pointer dereference (CWE-476) in the Linux kernel's __iio_device_register function within the IIO core subsystem. Commit 813665564b3d changed label retrieval to use firmware node handles instead of OF (Open Firmware) nodes, but failed to account for the case where a device has no parent, resulting in a NULL pointer dereference when accessing the parent's firmware node. The bug is triggered locally by a user with sufficient privileges to create entries in configfs under /sys/kernel/config/iio/devices/dummy/, causing a kernel BUG and system crash. Fixes are available as patches to the stable kernel tree (CVE.org, Feedly).

Successful exploitation results in a kernel NULL pointer dereference, causing a system crash (kernel panic/BUG) and denial of service. The impact is limited to availability — there is no evidence of code execution, privilege escalation, or data exfiltration potential associated with this vulnerability. The affected scope is limited to Linux systems with the IIO dummy driver and configfs enabled, which is not a typical production configuration (Feedly, CVE.org).

1. Precondition: Obtain local access to a Linux system with the IIO dummy kernel module loaded and configfs mounted (typically at /sys/kernel/config).
2. Trigger the vulnerability: Execute mkdir /sys/kernel/config/iio/devices/dummy/foo to create a new IIO dummy device entry via configfs.
3. Result: The kernel calls iio_dummy_probe → __iio_device_register, which attempts to access the firmware node of the NULL parent device, triggering a kernel NULL pointer dereference BUG and system crash (CVE.org, Feedly).

• Logs: Kernel logs (dmesg or /var/log/kern.log) showing BUG: kernel NULL pointer dereference with a call trace including __iio_device_register and iio_dummy_probe.
• File System: Presence of unexpected directories under /sys/kernel/config/iio/devices/dummy/ created by non-administrative users.
• Process: Unexpected or repeated kernel panics or system reboots on systems with IIO dummy driver loaded.

Apply the upstream kernel patches that add a NULL check for the parent device in __iio_device_register before accessing the firmware node. Fixes are available in the stable kernel tree via commits 312f04ede209, a4b34cccff14, and b2a69969908f. As a workaround, unload the iio_dummy kernel module or restrict access to configfs on affected systems. SUSE has issued advisories (SUSE-2026-0281-1, SUSE-2026-20876-1) incorporating the fix (Feedly, Linux Security SUSE).