CVE-2026-53237: Linux mvebu GPIO NULL Pointer Dereference During Suspend/Resume

Technical summary

CVE-2026-53237 is a NULL pointer dereference in the mvebu GPIO driver's suspend/resume path (specifically mvebu_pwm_suspend() and mvebu_pwm_resume() functions). The mvebu_pwm member of the mvchip structure is initialized to NULL for GPIO banks that lack PWM functionality. During system power management transitions, the suspend callback unconditionally invokes these PWM functions without validating that mvchip->mvpwm is non-NULL. The crash occurs when regmap_read() attempts to access the blink_select field through the NULL pointer. The vulnerability is classified as CWE-476 (NULL Pointer Dereference) with a CVSS 3.1 score of 5.5 (MEDIUM severity, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), indicating local attack vector, low complexity, low privilege requirement, and availability impact only.

Business impact

This vulnerability enables local denial-of-service attacks against systems using the mvebu GPIO driver. Any user capable of initiating system suspend (typically unprivileged users on desktop/laptop systems, or system administrators on servers) can crash the kernel. For always-on infrastructure, embedded systems, or IoT deployments relying on Marvell Armada 370/XP hardware, unexpected system crashes disrupt availability, degrade service reliability, and may complicate remote management. The low barrier to exploitation amplifies risk in multi-tenant or guest-accessible environments.

Affected systems

The Linux kernel is affected across multiple versions. The vulnerability resides in the mvebu GPIO driver, which supports Marvell Armada 370/XP ARM-based System-on-Chip (SoC) platforms. Any Linux distribution or embedded system running a vulnerable kernel version on these Marvell ARM processors is susceptible. Systems without mvebu GPIO driver support or those using alternative GPIO implementations are not impacted. Verify your kernel version against the vendor advisory to confirm affected releases.

Exploitability

This vulnerability is highly exploitable in local access scenarios. No special privileges are required beyond the ability to trigger a system suspend operation—a capability available to regular users on many systems. No complex exploitation techniques, race conditions, or information leaks are necessary; a simple suspend operation reliably triggers the crash. The attack requires no network access, no special hardware, and no user interaction beyond initiating suspend. Systems where suspend functionality is restricted to privileged users face lower risk, but the ease of exploitation remains a significant concern for general-purpose systems.

Remediation

The fix is straightforward: add a NULL pointer check before invoking mvebu_pwm_suspend() and mvebu_pwm_resume(). The kernel patch validates that mvchip->mvpwm is not NULL before attempting to access PWM-related fields or calling PWM suspend/resume routines. This ensures GPIO banks without PWM functionality safely skip PWM operations during power management transitions. Apply the patched kernel version from your Linux distribution or the upstream kernel repository. Verify the patch has been integrated into your specific kernel branch before deployment.

Patch guidance

Check your Linux distribution's kernel update channels for a patched version incorporating the mvebu GPIO NULL pointer fix. Upstream Linux kernel maintainers have resolved this issue; verify that your kernel version includes the fix commit in the gpio subsystem. If using a custom or vendor-specific kernel, contact your supplier for an updated image. Test the patched kernel in a non-production environment to validate suspend/resume functionality on your Marvell Armada hardware before rolling out to production systems. Document the patched kernel version in your change management system.

Detection guidance

Monitor system logs for kernel oops/panic messages originating from the regmap_mmio_read() or mvebu_gpio_suspend() functions, particularly around system suspend/resume events. Kernel crash dumps will display a call trace matching the one in the CVE description. On systems with kernel crash reporting enabled, capture and analyze dump files for evidence of this specific NULL pointer dereference. If your environment supports kernel module instrumentation, consider adding tracepoint logging to gpio_suspend operations to detect premature failures before they crash the system. Correlation of unexpected reboots with scheduled suspend operations is a practical detection signal.

Why prioritize this

While CVSS 5.5 (MEDIUM) reflects the availability-only impact, the trivial exploitability—requiring no privilege escalation, no special setup, and no user interaction beyond a standard system operation—argues for prompt patching. The combination of ease of exploitation and potential for unexpected infrastructure downtime justifies treating this as a moderate-to-high priority in any environment where mvebu GPIO hardware is deployed and suspend functionality is operational. Prioritize systems where suspend is regularly used (laptops, power-managed servers) over those where suspend is disabled.

Risk score, explained

The CVSS 3.1 score of 5.5 reflects high availability impact (A:H) due to reliable kernel crash, offset by local-only attack surface and low privilege requirement. No confidentiality or integrity impact is possible. The score appropriately captures that while the vulnerability is easy to trigger and guarantees denial-of-service, it does not enable privilege escalation, data theft, or system compromise. Organizations should consider contextual factors: systems in high-availability clusters, always-on production environments, or embedded deployments face greater business risk than the raw CVSS suggests.

Frequently asked questions