CVE-2023-54249: 
Linux Debian vulnerability analysis and mitigation

CVE-2023-54249 is a null pointer dereference vulnerability in the Linux kernel's MHI (Modem Host Interface) endpoint bus driver (bus: mhi: ep). The flaw occurs because the driver unconditionally sends a -ENOTCONN channel disconnect status for STOP and RESET commands even when no client driver is attached, leading to a null pointer dereference. It affects Linux kernel versions from 5.19 up to (but not including) the patched stable releases. Fixed versions include kernel 6.1.16, 6.2.3, and 6.3. The vulnerability was published on December 30, 2025, with a CVSS base score of 0.0 (no official CVSS rating assigned at time of publication) (Feedly, ENISA EUVD).

The root cause is a missing null check (CWE-476: NULL Pointer Dereference) in the MHI endpoint driver within the Linux kernel. When the host sends a STOP or RESET command to an MHI endpoint channel, the driver attempts to notify the client driver of the disconnect by sending a -ENOTCONN status. If no client driver is bound to the channel at that moment, the driver dereferences a null pointer, causing a kernel crash. The fix adds a guard to check for client driver availability before attempting to send the disconnect status (Feedly, kernel.org patch 6.1.16, kernel.org patch 6.2.3).

Successful exploitation of this vulnerability causes a kernel null pointer dereference, resulting in a system crash (kernel panic) and denial of service. The primary impact is on availability; there is no evidence of confidentiality or integrity compromise. Systems using MHI endpoint functionality — typically embedded or mobile platforms with modem interfaces — are at risk of unexpected reboots or service interruption (Feedly, ENISA EUVD).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2023-54249. The EPSS score is approximately 0.022% (0.000220), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation would require local or privileged access to trigger MHI STOP/RESET commands against an unbound channel, limiting the practical attack surface (Feedly).

Apply the upstream Linux kernel patches that introduce the null check before sending the -ENOTCONN status. Fixed versions are available in stable kernel releases 6.1.16, 6.2.3, and 6.3. Downstream Linux distributions should apply their respective vendor kernel updates. No configuration-based workaround is known; upgrading to a patched kernel version is the recommended remediation (kernel.org patch 6.1.16, kernel.org patch 6.2.3, kernel.org patch 6.3).