CVE-2023-54044: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54044 is a NULL pointer dereference vulnerability in the Linux kernel's SPMI (System Power Management Interface) subsystem. The flaw occurs when removing a SPMI driver that does not have a remove callback defined, causing a kernel panic. It affects Linux kernel versions from 3.15 up to the patched stable releases (4.14.315, 4.19.283, 5.4.243, 5.10.180, 5.15.111, 6.1.28, 6.2.15, 6.3.2, and 6.4). The vulnerability was published on December 24, 2025, with an EPSS score of approximately 0.033% (Feedly, ENISA EUVD). No CVSS base score has been assigned at this time.

The root cause is a missing NULL pointer check (CWE-476) in the spmi_drv_remove() function within the Linux kernel's SPMI bus driver framework. When a SPMI driver is unloaded (e.g., via rmmod), the kernel calls spmi_drv_remove(), which unconditionally invokes the driver's remove callback without first verifying that the callback pointer is non-NULL. Drivers that allocate all resources via devm_() APIs may legitimately omit a remove callback, triggering a NULL pointer dereference and kernel panic upon module removal. The fix adds a conditional check for the presence of the remove callback before invoking it (Feedly, Kernel Patch).

Successful triggering of this vulnerability results in a kernel panic (system crash), causing a denial of service on the affected host. The crash is observable in the call trace involving spmi_drv_remove, device_release_driver_internal, and driver_detach, as documented in the QCOM SPMI PMIC driver removal scenario. There is no evidence of confidentiality or integrity impact; the primary consequence is availability loss on systems running affected kernel versions with SPMI-based hardware (common in ARM64/Qualcomm-based devices) (Feedly).

The Linux kernel maintainers have released patches across all affected stable branches. Users should update to the following patched versions or later: 4.14.315, 4.19.283, 5.4.243, 5.10.180, 5.15.111, 6.1.28, 6.2.15, 6.3.2, or 6.4. As a temporary workaround, administrators can avoid unloading SPMI drivers on affected systems until the kernel is updated. Downstream Linux distributions (e.g., Red Hat, Ubuntu) should be monitored for their respective kernel update advisories (Feedly, Kernel Patch).