CVE-2023-54249: bus: mhi: ep: Only send -ENOTCONN status if client driver is available

Severity: unknown
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-12-30 · updated 2026-06-17

Description

In the Linux kernel, the following vulnerability has been resolved: bus: mhi: ep: Only send -ENOTCONN status if client driver is available For the STOP and RESET commands, only send the channel disconnect status -ENOTCONN if client driver is available. Otherwise, it will result in null pointer dereference.

Affected products

Linux kernel: 5.19 — fixed in 6.3

How to fix

Upgrade to a fixed version: Linux kernel 6.3. Check the vendor advisory for mitigations.

References

https://git.kernel.org/stable/c/353aea15d6edbd4e69e039356a1bd3e641f7d952
https://git.kernel.org/stable/c/860ad591056d7e4dc30bc130b6ec6e6d70930c85
https://git.kernel.org/stable/c/e6cebcc27519dcf1652e604c73b9fd4f416987c0

Get alerted when CVE-2023-54249 or the next vulnerability affects your stack