CVE-2023-54287

What it actually does

Race condition in imx UART serial driver allows pending USR interrupts to trigger NULL pointer dereference in __imx_uart_rxint before uart_add_one_port completes, causing kernel panic on ARM platforms under Jailhouse hypervisor.

Why it matters to the business

Unexpected system crashes and loss of console access during repeated virtualization cell start/stop cycles on affected embedded Linux devices, leading to operational downtime in hypervisor-managed environments.

How an attack unfolds

An attacker with ability to trigger rapid jailhouse cell enable/destroy sequences while generating UART input can leave pending interrupts; restarting the guest kernel without prior IRQ disable in UCR2 causes the handler to dereference an uninitialized port structure.

How to fix it

Update the Linux kernel to a version containing commit 3d41d9b256ae626c0dc434427c8e32450358d3b4 or later; ensure both UCR1 and UCR2 interrupt sources are masked prior to irq request in the imx driver.

How to confirm the fix worked

Boot patched kernel under the same Jailhouse cell create/destroy loop while generating UART traffic; confirm absence of the NULL pointer oops at address 0x80 and verify UCR2 Ageing Timer bit is cleared before request_irq.

Typical attack path

1. Enable Jailhouse hypervisor and load imx8mp.cell configuration
2. Start second Linux cell and begin generating serial console input
3. Destroy the cell without quiescing the UART
4. Immediately restart the cell to re-trigger the pending interrupt path
5. Observe kernel NULL pointer dereference and panic

How to detect it

Search kernel logs for Oops messages containing __imx_uart_rxint.constprop.0 and ESR 0x0000000096000004; correlate with Jailhouse cell destroy events and UART activity in dmesg or serial console captures.

What your security team should do

• Prioritize kernel upgrade on all imx8 series devices running Jailhouse or similar hypervisors
• Add the specific commit to internal kernel build and CI validation pipelines
• Monitor for kernel oops reports referencing __imx_uart_rxint during cell lifecycle operations