CVE-2023-54059

What it actually does

A NULL pointer dereference occurs in the svs_isr interrupt handler of the mediatek mtk-svs driver when the IRQ is enabled before data structures are initialized, which can happen on non-reset boots such as kexec.

Why it matters to the business

Systems using kexec or similar non-standard boot methods may experience kernel crashes at startup, resulting in boot failures, operational downtime, and potential loss of availability on affected Linux deployments.

How an attack unfolds

An attacker with local or physical access triggers a kexec-based boot on an unpatched kernel; the peripheral fires an IRQ before driver data structures are ready, causing svs_isr to dereference a null pointer and panic the kernel.

How to fix it

Update the Linux kernel to a version containing commit 6b99ebd30d65ee5ab8e8dd1d378550911eff5e4f which moves IRQ enablement after data-structure initialization in the mtk-svs driver.

How to confirm the fix worked

Confirm the running kernel source or binary contains the patch that enables the IRQ after initialization in mtk-svs; test kexec boot on a patched system to verify no crash occurs.

Typical attack path

1. Obtain ability to initiate kexec or equivalent non-reset boot
2. Boot the system so that the peripheral IRQ fires early
3. Trigger NULL pointer dereference inside svs_isr leading to kernel panic

How to detect it

Inspect kernel logs and boot traces for NULL pointer dereference at address 0000000000000f08 with a call trace containing svs_isr shortly after startup on systems that use kexec.

What your security team should do

• Apply the referenced kernel commit or later stable release immediately on all affected systems
• Disable or restrict kexec usage until patches are deployed
• Include mtk-svs driver changes in kernel update testing and deployment pipelines