CVE-2023-54304: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54304 is a NULL pointer dereference vulnerability in the Linux kernel's firmware/meson_sm driver. The flaw arises because of_match_device() may return a NULL pointer, and the code did not check this return value before use. It affects Linux kernel versions from 5.5 up to (but not including) the patched stable releases. The CVE was published on December 30, 2025, and carries an EPSS score of approximately 0.024% (very low exploitation probability), with no CVSS base score assigned at time of publication (Feedly, ENISA EUVD).

The root cause is a missing NULL pointer check (CWE-476: NULL Pointer Dereference) in the meson_sm firmware driver within the Linux kernel. The function of_match_device() is called to match a device against a table of device tree entries; if no match is found, it returns NULL. Without validating this return value, subsequent dereference of the NULL pointer can trigger a kernel panic or oops. The fix, applied across multiple stable branches, adds an explicit check on the return value of of_match_device() before proceeding (Feedly, ENISA EUVD).

Successful triggering of this vulnerability can cause a kernel NULL pointer dereference, resulting in a kernel panic or system crash, which impacts availability. Because the flaw resides in a firmware driver (meson_sm) typically loaded on Amlogic Meson SoC-based systems, exploitation would require local access or the ability to influence device tree matching. There is no evidence of confidentiality or integrity impact beyond the denial-of-service condition caused by the crash (Feedly).

The fix has been backported to multiple Linux stable kernel branches. Patched versions include Linux 5.10.195, 5.15.132, 6.1.53, 6.4.16, 6.5.3, and 6.6 (mainline). Users running affected kernel versions on Amlogic Meson SoC-based systems should upgrade to one of these patched releases. No configuration-based workaround is documented; upgrading the kernel is the recommended remediation (ENISA EUVD, Feedly).