CVE-2023-54058: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54058 is a NULL pointer dereference vulnerability in the Linux kernel's firmware: arm_ffa subsystem. The flaw exists in ffa_device_remove(), which unconditionally calls ffa_drv->remove() without first checking whether the .remove callback was registered by the driver. This can trigger a kernel NULL pointer dereference when a module is unloaded (e.g., via rmmod) if the driver was registered without a .remove callback. The vulnerability was published on December 24, 2025, and affects the Linux kernel (CVE Record). No CVSS score has been officially assigned at this time.

The root cause is a missing NULL check before a function pointer dereference (CWE-476: NULL Pointer Dereference). The ARM Firmware Framework for Armv8-A (FF-A) driver registration path does not require a .remove callback, yet ffa_device_remove() calls ffa_drv->remove() unconditionally. When a kernel module registered without a .remove callback is unloaded, the kernel attempts to execute a function at address 0x0, resulting in an instruction abort (IABT) at EL1. The crash trace shows the fault originating at ffa_device_remove+0x20/0x2c → device_release_driver_internal → driver_detach → bus_remove_driver → driver_unregister → ffa_driver_unregister → cleanup_module. The fix adds a NULL check for ffa_drv->remove before invoking it (CVE Record, Feedly).

Successful triggering of this vulnerability causes a kernel panic (Oops) on the affected system, resulting in a denial of service (system crash). The impact is limited to availability — confidentiality and integrity are not directly affected. Exploitation requires the ability to load and unload kernel modules, which typically requires elevated (root or CAP_SYS_MODULE) privileges, limiting the blast radius to privileged local users or compromised kernel module workflows (CVE Record).

Apply the upstream Linux kernel patches that add a NULL check for ffa_drv->remove before invoking it in ffa_device_remove(). Patches have been submitted to the stable kernel tree across multiple stable branches (referenced by commits 6a26c62625c5, 48399c297c46, ad73dc7263ea, and b71b55248a58). Until patched, administrators can mitigate risk by restricting the ability to load and unload kernel modules (e.g., via CAP_SYS_MODULE restrictions or kernel lockdown mode). Monitor vendor distributions (Red Hat, Ubuntu, SUSE, etc.) for backported fixes in their respective kernel packages (CVE Record, Tenable).