NULL pointer dereference in Linux
CVE-2023-53049
In the Linux kernel, the following vulnerability has been resolved: usb: ucsi: Fix NULL pointer deref in ucsi_connector_change() When ucsi_init() fails, ucsi->connector is NULL, yet in case of ucsi_acpi we may still get events which cause the ucs_acpi code to call ucsi_connector_change(), which then derefs the NULL ucsi->connector pointer. Fix this by not setting ucsi->ntfy inside ucsi_init() until ucsi_init() has succeeded, so that ucsi_connector_change() ignores the events because UCSI_ENABLE_NTFY_CONNECTOR_CHANGE is not set in the ntfy mask.
EPSS: 0.002 (7.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Linux — versions bdc62f2bae8fb0e8e99574de5232f0a3c54a27df, 5.5, 0
- Linux Linux_kernel — versions 6.3
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2023-53049?
- CVE-2023-53049 is a medium-severity vulnerability in Linux, classified under NULL Pointer Dereference. CVSS score: 5.5/10. Published 2025-05-02.
- How severe is CVE-2023-53049?
- Medium severity. CVSS v3 base score is 5.5 out of 10.