CVE-2023-54220: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54220 is a kernel oops (null/stale pointer dereference) vulnerability in the Linux kernel's 8250 serial driver, specifically in the uart_change_pm() code path. When a hardware-specific 8250 driver is unloaded, the port->pm function pointer is not cleared, causing serial8250_pm() to call the now-invalid port->pm() instead of serial8250_do_pm() approximately ten seconds later when uart_hangup() triggers uart_change_pm(). This results in a kernel panic with the message "Unable to handle kernel paging request at virtual address." The vulnerability was published on December 30, 2025, and affects multiple stable Linux kernel branches. No CVSS score has been formally assigned; Feedly estimates the severity as Medium with an EPSS score of 0.000240 (Feedly, ENISA EUVD).

The root cause is an incomplete cleanup of the port->pm function pointer when a hardware-specific 8250 UART driver is unbound (CWE-825: Expired Pointer Dereference / use-after-free of a function pointer). Commit 04e82793f068 ("serial: 8250: Reinit port->pm on port specific driver unbind") only reinitializes port->ops but does not clear port->pm. When the driver is subsequently unloaded and uart_hangup() calls uart_change_pm(), serial8250_pm() checks port->pm and, finding it non-NULL, calls the now-dangling function pointer, triggering a kernel oops. The fix requires explicitly setting port->pm = NULL during driver unbind so that serial8250_pm() falls back to serial8250_do_pm() (Feedly, Kernel Fix 6.4.x).

Successful triggering of this vulnerability causes a kernel panic (oops) on the affected system, resulting in a denial of service — the system crashes or becomes unresponsive. The impact is limited to availability; there is no evidence of confidentiality or integrity compromise, and no known path to privilege escalation or remote code execution. The vulnerability requires local access to load and unload a hardware-specific 8250 serial driver, limiting the affected asset scope to systems with such hardware and driver management privileges (Feedly).

The Linux kernel stable team has released fixes across multiple stable branches: 4.14.324, 4.19.293, 5.4.255, 5.10.192, 5.15.128, 6.1.47, 6.4.12, and 6.5+. Administrators should update to a patched kernel version for their respective stable branch. The fix involves clearing port->pm to NULL during hardware-specific 8250 driver unbind, ensuring serial8250_pm() correctly falls back to serial8250_do_pm() (Feedly, ENISA EUVD). As a workaround, avoiding unloading hardware-specific 8250 drivers on production systems can prevent the oops from being triggered.