CVE-2026-53344: pinctrl: mcp23s08: Initialize mcp->dev and mcp->addr before regmap init
In the Linux kernel, the following vulnerability has been resolved:
pinctrl: mcp23s08: Initialize mcp->dev and mcp->addr before regmap init
Regmap initialization triggers regcachemaplepopulate() which attempts SPI read to populate cache. SPI read requires mcp->dev and mcp->addr to be set, without them, NULL pointer dereference occurs during probe.
Move initialization before mcp23s08spiregmapinit() call.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the pinctrl mcp23s08 driver so that mcp->dev and mcp->addr are set prior to the mcp23s08_spi_regmap_init() regmap init call, preventing NULL pointer dereference during probe.
Linux kernel (pinctrl: mcp23s08) Initialization order = Initialize mcp->dev and mcp->addr before calling mcp23s08_spi_regmap_init()
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53344?
CVE-2026-53344 has a risk rating of 16, indicating a significant vulnerability.
How do I fix CVE-2026-53344?
To fix CVE-2026-53344, ensure that mcp->dev and mcp->addr are initialized before the regmap initialization in the Linux kernel.
What systems are affected by CVE-2026-53344?
CVE-2026-53344 affects various versions of the Linux kernel that include the pinctrl MCP23S08 driver.
What type of vulnerability is CVE-2026-53344?
CVE-2026-53344 is classified as a Null Pointer Dereference vulnerability.
When was CVE-2026-53344 published?
CVE-2026-53344 was published on July 1, 2026.