PT-2025-38371 · Linux+3 · Linux Kernel+3

Published 2023-11-07 · Updated 2025-09-29 · CVE-2023-53392

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.16

Description The Linux kernel contained a flaw where a kernel panic could occur during a warm reset. This occurred because the device->fw client was set to NULL during a warm reset. If a bus driver was registered after this NULL setting and before new firmware clients were enumerated, a kernel panic resulted in the ishtp cl bus match() function due to a reference to device->fw client->props.protocol name. The issue was exposed after a change in kernel version 5.16 that loaded bus drivers only for matching devices, specifically with the cros ec ishtp device and driver.

Recommendations Update to kernel version 5.16 or later to resolve this issue.

Exploit

Fix

Exposure of Resource to Wrong Sphere

NULL Pointer Dereference

Weakness Enumeration

CWE-668

CWE-476

Related Identifiers

ALSA-2025_16880

BDU:2026-06024

CESA-2024_3138

CVE-2023-53392

RHSA-2023:6583

RHSA-2023_6583

RHSA-2024:3138

RHSA-2024_3138

Affected Products

Astra Linux

Centos

Linux Kernel

Red Hat

References · 21

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53392.json · Exploit
• https://git.kernel.org/stable/c/45b9055a3a3ff6e8c08faad82ea36a8644a81587 · Patch
• https://osv.dev/vulnerability/BELL-CVE-2023-53392 · Vendor Advisory
• https://git.kernel.org/stable/c/38518593ec55e897abda4b4be77b2ec8ec4447d1 · Patch
• https://git.kernel.org/stable/c/6c8cc40c588f8080a164d88336b1490279e0f1da · Patch
• https://ubuntu.com/security/CVE-2023-53392 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-53392 · Security Note
• https://osv.dev/vulnerability/CVE-2023-53392 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-53392 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-53392 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2023-53392 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-06024 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-53392 · Vendor Advisory
• https://access.redhat.com/security/cve/cve-2023-53392 · Note
• https://lore.kernel.org/linux-cve-announce/2025091858-CVE-2023-53392-9703@gregkh/T · Note