CVE-2023-53658

spi: bcm-qspi: return error if neither hif_mspi nor mspi is available

MEDIUM
5.5
CVSS Score
Published: October 7, 2025 at 03:21 PM UTC
Updated: October 28, 2026 at 08:10 PM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.2%

Description

In the Linux kernel, the following vulnerability has been resolved: spi: bcm-qspi: return error if neither hif_mspi nor mspi is available If neither a "hif_mspi" nor "mspi" resource is present, the driver will just early exit in probe but still return success. Apart from not doing anything meaningful, this would then also lead to a null pointer access on removal, as platform_get_drvdata() would return NULL, which it would then try to dereference when trying to unregister the spi master. Fix this by unconditionally calling devm_ioremap_resource(), as it can handle a NULL res and will then return a viable ERR_PTR() if we get one. The "return 0;" was previously a "goto qspi_resource_err;" where then ret was returned, but since ret was still initialized to 0 at this place this was a valid conversion in 63c5395bb7a9 ("spi: bcm-qspi: Fix use-after-free on unbind"). The issue was not introduced by this commit, only made more obvious.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

4.15 ≤ v < 4.19.2914.20 ≤ v < 5.4.2514.9 ≤ v < 4.14.3225.11 ≤ v < 5.15.1215.16 ≤ v < 6.1.395.5 ≤ v < 5.10.1886.2 ≤ v < 6.4.44.9fa236a7ef24048bafaeed13f68df35a819794758
Vendor states this is fixed in 217b6ea8cf7b819477bca597a6ae2d43d38ba283 (fixed)
Vendor states this is fixed in 22ae32d80ef590d12a2364e4621f90f7c58445c7 (fixed)
Vendor states this is fixed in 32b9c8f7892c19f7f5c9fed5fb410b9fd5990bb6 (fixed)
Vendor states this is fixed in 398e6a015877d44327f754aeb48ff3354945c78c (fixed)
Vendor states this is fixed in 7c1f23ad34fcdace50275a6aa1e1969b41c6233f (fixed)
Vendor states this is fixed in a91c34357afcfaa5307e254f22a8452550a07b34 (fixed)
Vendor states this is fixed in d20db3c58a7f9361e370a7850ceb60dbdf62eea3 (fixed)
Vendor states this is fixed in d3dcdb43c872a3b967345144151a2c9bb9124c9b (fixed)
Vendor states this is fixed in 4.14.322 (unaffected)
Vendor states this is fixed in 4.19.291 (unaffected)
Vendor states this is fixed in 4.9 (unaffected)
Vendor states this is fixed in 5.10.188 (unaffected)
Vendor states this is fixed in 5.15.121 (unaffected)
Vendor states this is fixed in 5.4.251 (unaffected)
Vendor states this is fixed in 6.1.39 (unaffected)
Vendor states this is fixed in 6.4.4 (unaffected)
Vendor states this is fixed in 6.5 (unaffected)

CVSS

Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusANALYZED
CWE
CWE-476

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card