CVE-2023-53472: pwm: lpc32xx: Remove handling of PWM channels

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-10-01 · updated 2026-06-17
Weakness: CWE-476

Description

In the Linux kernel, the following vulnerability has been resolved: pwm: lpc32xx: Remove handling of PWM channels Because LPC32xx PWM controllers have only a single output which is registered as the only PWM device/channel per controller, it is known in advance that pwm->hwpwm value is always 0. On basis of this fact simplify the code by removing operations with pwm->hwpwm, there is no controls which require channel number as input. Even though I wasn't aware at the time when I forward ported that patch, this fixes a null pointer dereference as lpc32xx->chip.pwms is NULL before devm_pwmchip_add() is called.

Affected products

Linux kernel: from 4.9.284 before 4.10; from 4.14.248 before 4.14.326; from 4.19.208 before 4.19.295; from 5.4.149 before 5.4.257; from 5.10.69 before 5.10.195; from 5.14.8 before 5.15.132 — fixed in 4.10, 4.14.326, 4.19.295, 5.10.195, 5.15.132, 5.4.257

How to fix

Upgrade to a fixed version: Linux kernel 4.10, 4.14.326, 4.19.295, 5.10.195. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-53472 or the next vulnerability affects your stack