CVE-2026-45874

What it actually does

NULL pointer dereference in imx_hsio_configure_clk_pad() when the refclk_pad pointer remains unset because the fsl,refclk-pad-mode devicetree property is absent, causing a crash on unconditional dereference during PHY probe.

Why it matters to the business

System crashes or denial of service on affected i.MX8QM hardware during boot or driver initialization, interrupting operations on embedded Linux devices using this Freescale HSIO PHY.

How an attack unfolds

An attacker with local access supplies a devicetree lacking the fsl,refclk-pad-mode property; during kernel probe the pointer is set to NULL and later unconditionally dereferenced, triggering a kernel panic.

How to fix it

Apply the upstream fix that adds an explicit pointer check before use in imx_hsio_configure_clk_pad(); rebuild and deploy the patched kernel for affected Freescale i.MX8QM platforms.

How to confirm the fix worked

Inspect the driver source for a conditional check on refclk_pad before dereference; boot with a devicetree omitting the property and confirm no oops occurs.

Typical attack path

1. Obtain local access or ability to influence devicetree
2. Provide or modify devicetree node without fsl,refclk-pad-mode property
3. Trigger driver probe or module load
4. Cause NULL dereference and kernel crash

How to detect it

Search kernel logs and dmesg for oops or panic entries referencing imx_hsio_configure_clk_pad or NULL pointer dereference during PHY probe; correlate with device boot timelines.

• imx_hsio_configure_clk_pad
• NULL pointer dereference
• fsl,refclk-pad-mode
• phy: freescale: imx8qm-hsio

What your security team should do

• Prioritize kernel update containing the pointer validation fix
• Test boot with varied devicetree configurations on i.MX8QM hardware
• Monitor for related kernel panics in production fleets
• Restrict local access to devicetree modification where feasible