CVE-2023-54059: 
Linux Debian vulnerability analysis and mitigation

CVE-2023-54059 is a NULL pointer dereference vulnerability in the Linux kernel's MediaTek Smart Voltage Scaling (SVS) driver (soc/mediatek/mtk-svs). The flaw occurs when the system is booted via kexec() rather than a full hardware reset, causing the peripheral to trigger an interrupt request (IRQ) before the driver's data structures are fully initialized. It affects Linux kernel versions from the initial commit up to (but not including) the patched commits in the 6.1.18, 6.2.5, and 6.3 stable releases. The vulnerability was published on December 24, 2025, with an EPSS score of approximately 0.017% (very low), and no CVSS base score has been formally assigned (Feedly, EUVD).

The root cause is a race condition / improper initialization ordering (CWE-476: NULL Pointer Dereference) in the mtk-svs driver. When a system is rebooted using kexec(), the hardware peripheral is not fully reset and may fire an IRQ immediately upon driver load, before the svs_isr interrupt service routine's required data structures are allocated and initialized. The kernel crash trace shows a NULL pointer dereference at virtual address 0x0000000000000f08 within svs_isr+0x8c/0x538. The fix defers enabling the IRQ until after all data structures are initialized, eliminating the race window (Feedly, Kernel Patch 1, Kernel Patch 2).

Successful triggering of this vulnerability causes a kernel NULL pointer dereference, resulting in a kernel panic and system crash (denial of service). The impact is limited to availability — there is no evidence of confidentiality or integrity compromise, and the vulnerability cannot be used for privilege escalation or remote code execution. The affected scope is limited to systems using MediaTek SoCs with the SVS driver that are rebooted via kexec() rather than a hardware reset (Feedly).

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution associated with CVE-2023-54059. The EPSS score is approximately 0.017%, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Triggering the bug requires physical or privileged access to initiate a kexec() reboot on a MediaTek SVS-equipped system, significantly limiting the attack surface (Feedly).

The Linux kernel stable tree has released patches addressing this vulnerability in versions 6.1.18, 6.2.5, and 6.3. The fix moves IRQ enablement to after data structure initialization in the mtk-svs driver. Users running affected MediaTek-based systems should update to a patched kernel version. As a workaround, avoiding kexec()-based reboots on affected hardware prevents triggering the vulnerability (Kernel Patch 1, Kernel Patch 2, Kernel Patch 3).