CVE-2026-53344: Linux Kernel mcp23s08 NULL Pointer Dereference During Probe

Technical summary

The mcp23s08 SPI driver initializes a regmap (register map abstraction layer) before setting the mcp->dev and mcp->addr pointers. Regmap initialization invokes regcache_maple_populate(), which triggers an immediate SPI read operation to pre-populate the register cache. This read operation dereferences mcp->dev and mcp->addr, which remain NULL at that point, causing a kernel NULL pointer dereference (CWE-908). The fix reorders initialization to set mcp->dev and mcp->addr before calling mcp23s08_spi_regmap_init().

Business impact

Systems relying on the MCP23S08 GPIO expander—common in embedded systems, industrial controllers, and IoT platforms—will fail to boot or initialize the pinctrl subsystem. This denial-of-service condition prevents affected hardware from becoming operational, impacting production environments that depend on GPIO expansion for peripheral control. Organizations running affected kernel versions on such platforms must prioritize patching to restore availability.

Affected systems

The vulnerability affects the Linux kernel pinctrl mcp23s08 driver. Systems utilizing MCP23S08 SPI-based GPIO expanders require the patched kernel version. This includes embedded Linux distributions, industrial control systems, and IoT devices that rely on the mcp23s08 driver for GPIO expansion. Desktop and server environments without MCP23S08 hardware are unaffected.

Exploitability

Exploitability is limited to systems with MCP23S08 hardware present. An attacker requires local system access with sufficient privileges to trigger device probe or driver reload, making spontaneous remote exploitation impossible. The vulnerability manifests as a guaranteed crash during normal driver initialization when preconditions are met. No privilege escalation or data exfiltration is possible—the impact is denial of service only.

Remediation

Apply a kernel update containing the fix that reorders initialization to set mcp->dev and mcp->addr before regmap initialization. Verify the patch against your Linux kernel version's upstream repository or your distribution's security advisories. For systems with MCP23S08 hardware that cannot be patched immediately, consider disabling the mcp23s08 driver if not actively required, though this eliminates GPIO expansion capability.

Patch guidance

Consult your Linux distribution's kernel security advisories for the specific patched kernel version addressing CVE-2026-53344. Upstream kernel repositories contain the fix in the pinctrl subsystem. Test patched kernels in pre-production environments on affected hardware to confirm GPIO expansion functionality before production deployment. If using a vendor-specific Linux distribution (embedded, IoT, or industrial), coordinate with the vendor's release schedule for backported fixes.

Detection guidance

Monitor kernel logs for NULL pointer dereference errors during boot or device initialization, particularly those mentioning the mcp23s08 driver or pinctrl subsystem. Check for repeated driver probe failures when MCP23S08 hardware is present. Use 'lsmod | grep mcp23s08' to identify if the driver is loaded, and verify successful probe completion via dmesg or journalctl. Kernel crash dumps or spontaneous reboots during initialization on systems with MCP23S08 hardware may indicate exploitation.

Why prioritize this

Although the CVSS score is moderate (5.5), the practical impact is high for affected deployments: systems with MCP23S08 hardware become unavailable until patched. The vulnerability is trivial to trigger during normal operation (driver probe), making reliability a business driver rather than security theater. Organizations running affected architectures should prioritize patching to restore system availability.

Risk score, explained

The CVSS 3.1 score of 5.5 (MEDIUM) reflects a local-only attack vector, no privilege escalation, and availability impact only. The vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H correctly captures the local-only requirement, low attack complexity, moderate privilege requirement, and high availability impact. However, for systems with MCP23S08 hardware, the practical risk is higher because the crash is deterministic and prevents normal operation.

Frequently asked questions