CVE-2026-53344

What it actually does

This is a local denial-of-service flaw in the Linux kernel MCP23S08 pin controller driver. During SPI device probe, the driver initializes regmap before setting required internal fields for the target device and address. Regmap cache population can trigger an SPI read that dereferences uninitialized or NULL driver state, causing a kernel NULL pointer dereference. The expected result is a kernel oops, driver probe failure, or potentially a system crash depending on kernel configuration and fault handling. The issue affects availability only; the provided CVSS vector indicates no direct confidentiality or integrity impact.

Why it matters to the business

Systems that use the affected Linux kernel driver for MCP23S08/MCP23S17-style GPIO expander hardware may become unstable or unavailable during device initialization, boot, module loading, or hardware probing. In operational technology, embedded, appliance, or edge environments where GPIO expanders are part of platform control, this could interrupt device startup or reduce hardware functionality. The risk is lower for general-purpose Linux systems that do not include or load this driver and require local privileges or local device interaction to trigger the vulnerable code path. It is not listed in CISA KEV, has no known ransomware association, and has very low EPSS, so broad internet-scale exploitation is unlikely based on currently available intelligence.

How an attack unfolds

An attacker would need local access with sufficient privileges or influence over device enumeration, module loading, or hardware configuration to cause the affected MCP23S08 pin controller driver to probe an SPI-attached device. When the vulnerable driver begins initialization, regmap setup attempts to populate its cache and performs an SPI read. Because the driver has not yet initialized the device and address fields needed by the SPI read path, the kernel dereferences invalid state. This can crash the driver probe path and may produce a kernel oops or panic, resulting in local denial of service. There is no indication from the supplied data that this vulnerability enables privilege escalation, remote code execution, or data theft.

How to fix it

Update to a Linux kernel version or vendor kernel package that includes the MCP23S08 pinctrl fix that initializes mcp->dev and mcp->addr before regmap initialization. Because no exact fixed versions were provided, use the latest stable kernel release or the latest distribution/vendor security update for affected kernel branches. For systems that do not require this hardware support, consider disabling or blacklisting the affected driver as a mitigation. Where possible, restrict local administrative capabilities that allow loading kernel modules, applying device tree overlays, or initiating hardware reprobe operations. Embedded and appliance vendors should backport the upstream patch into maintained kernel trees and validate boot/probe behavior on hardware using MCP23S08-compatible GPIO expanders.

How to confirm the fix worked

Confirm that the running kernel includes the patch moving mcp->dev and mcp->addr initialization before mcp23s08_spi_regmap_init(). Validate by checking vendor advisories, kernel package changelogs, or source code for the corrected initialization order in the MCP23S08 driver. On affected hardware, reboot or reload the driver in a controlled test environment and confirm that the MCP23S08 device probes successfully without kernel oops messages. Check that loaded kernel modules and the running kernel version match the patched package, not only the installed package on disk. If the driver is mitigated by disabling it, confirm it is not loaded and cannot be auto-loaded under normal boot or device enumeration conditions.

Typical attack path

1. Obtain local access to a Linux system or control over a local device configuration path that can influence SPI device probing.
2. Cause the affected MCP23S08 pin controller driver to load or re-probe a matching SPI device, such as through module loading, device tree overlay changes, or hardware enumeration where permitted.
3. Trigger driver initialization so mcp23s08_spi_regmap_init() runs before required device/address fields are initialized.
4. Regmap cache population performs an SPI read using uninitialized driver state.
5. The kernel encounters a NULL pointer dereference, causing a probe failure, kernel oops, or system crash.

How to detect it

Review kernel logs and persistent journal records for evidence of crashes or probe failures involving the MCP23S08 pinctrl driver, SPI regmap initialization, or NULL pointer dereferences during device initialization. Useful log sources include dmesg, /var/log/kern.log, /var/log/messages, systemd journal kernel records, pstore/ramoops, kdump/vmcore artifacts, and embedded device serial console logs. Look for crashes clustered around boot, module loading, SPI device enumeration, device tree overlay application, or manual reprobe actions. Because exploitation requires local interaction and there are no known public exploit artifacts in the supplied intelligence, detection should focus on kernel oops signatures and suspicious local administrative activity preceding the crash, such as module insertion, overlay changes, or sysfs driver bind/unbind operations. Correlate crash timing with authentication logs, sudo logs, shell history where available, package or firmware update events, and hardware configuration changes.

• mcp23s08
• mcp23s08_spi_regmap_init
• mcp23s08_probe
• pinctrl-mcp23s08
• NULL pointer dereference
• Unable to handle kernel NULL pointer dereference
• kernel NULL pointer dereference
• Oops:
• Kernel panic - not syncing
• regcache_maple_populate
• regmap_init
• SPI read
• /var/log/kern.log
• /var/log/messages
• /sys/bus/spi/drivers
• /sys/bus/spi/drivers/mcp23s08/bind
• /sys/bus/spi/drivers/mcp23s08/unbind
• /sys/kernel/debug/pinctrl
• /sys/fs/pstore
• ramoops
• vmcore
• kdump

What your security team should do

• Prioritize patching Linux systems, embedded devices, and appliances that use MCP23S08/MCP23S17-compatible GPIO expanders or load the mcp23s08 pinctrl driver.
• Inventory kernels and hardware platforms for use of the affected driver; deprioritize systems where the driver is absent, not built, or never loaded.
• Apply the latest vendor-supported kernel update or backport the upstream driver initialization fix into maintained kernel builds.
• If immediate patching is not possible, disable or blacklist the affected driver on systems that do not require it.
• Restrict local administrative paths that allow kernel module loading, device tree overlay modification, or forced device reprobe.
• Monitor kernel logs for NULL pointer dereferences, kernel oops, or panic events involving the mcp23s08 or regmap SPI probe path.
• For embedded products, include regression testing for boot-time SPI GPIO expander probing before releasing patched firmware.