CVE-2023-54044

What it actually does

NULL pointer dereference panic in spmi_drv_remove when an SPMI driver lacking a remove callback is unregistered, triggered via device_release_driver_internal during module unload.

Why it matters to the business

Unloading affected kernel modules can cause immediate system crashes and downtime; organizations running custom or vendor SPMI drivers on Linux kernels face elevated operational risk until patched.

How an attack unfolds

An attacker with sufficient privileges to unload a vulnerable SPMI driver module (such as qcom_spmi_pmic) triggers the removal path; the kernel calls spmi_drv_remove without checking for a remove callback, dereferences a NULL function pointer, and panics.

How to fix it

Update to a kernel containing commit b95a69214daea4aab1c8bad96571d988a62e2c97 or later; for Chainguard images upgrade mattermost-10.3 and mattermost-10.3-compat to 10.3.4-r9 or newer.

How to confirm the fix worked

Confirm the presence of the guard checking for a remove callback in spmi_drv_remove; verify kernel version or git commit b95a69214daea4aab1c8bad96571d988a62e2c97 is applied.

Typical attack path

1. Obtain local access or code execution allowing module unload
2. Invoke rmmod or delete_module on the target SPMI driver
3. Kernel executes spmi_drv_remove without callback guard
4. NULL dereference occurs leading to panic and denial of service

How to detect it

Search kernel logs and crash dumps for the stack trace containing spmi_drv_remove, device_release_driver_internal, driver_detach, and __do_sys_delete_module; correlate with module unload timestamps.

• spmi_drv_remove+0x16c/0x1e0
• dump_backtrace.cfi_jt+0x0/0x8
• __do_sys_delete_module+0x3ec/0x53c
• qcom_spmi_pmic

What your security team should do

• Prioritize kernel updates containing the referenced commit on all affected systems
• Audit custom SPMI drivers for explicit remove callbacks or devm_ resource usage
• Monitor module unload events in production environments until patches are deployed