VulnerabilityPublished 25 Jun 2026Updated 30 Oct 2026

CVE-2026-53237: Linux kernel · gpio: mvebu: fix NULL pointer dereference in suspend/resume

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in c9677a9274ffb44987ec209dc8ec9f2d34946956 : patch Linux kernel soon.

Data as of 30 Oct 2026, 12:49 UTC

Severity

High

Rated High by Threat Radar's AI analysis · No CVSS score from NVD or the CNA

Thin evidence

One scorer or none

Patch: Available – fixed in c9677a9274ffb44987ec209dc8ec9f2d34946956, b9ad50d7505ebd48282ec3630258dc820fc85c81, 6136c1474db88272231573e222896e1998d34662 +3

Exploitation evidence

Disclosed: evidence found.
CVE published 25 Jun 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 30 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 757642f9a584e893f3f4e50c99b674ee8a3ed363, < c9677a9274ffb44987ec209dc8ec9f2d34946956	Fixed in c9677a9274ffb44987ec209dc8ec9f2d34946956
LinuxLinux	Affected ≥ 757642f9a584e893f3f4e50c99b674ee8a3ed363, < b9ad50d7505ebd48282ec3630258dc820fc85c81	Fixed in b9ad50d7505ebd48282ec3630258dc820fc85c81
LinuxLinux	Affected ≥ 757642f9a584e893f3f4e50c99b674ee8a3ed363, < 6136c1474db88272231573e222896e1998d34662	Fixed in 6136c1474db88272231573e222896e1998d34662
LinuxLinux	Affected ≥ 757642f9a584e893f3f4e50c99b674ee8a3ed363, < 7db09011ce62162d72897fc4856b4425245dfe35	Fixed in 7db09011ce62162d72897fc4856b4425245dfe35
LinuxLinux	Affected ≥ 757642f9a584e893f3f4e50c99b674ee8a3ed363, < 4ef24338eda3c7e96d6f94a988266ff16ed3985d	Fixed in 4ef24338eda3c7e96d6f94a988266ff16ed3985d
LinuxLinux	Affected ≥ 757642f9a584e893f3f4e50c99b674ee8a3ed363, < 3cb53f89049c3769e102ac5b7692e679a1d45510	Fixed in 3cb53f89049c3769e102ac5b7692e679a1d45510

AI-suggested

A fix is available in the Linux kernel as indicated by the listed fixed commit versions. Users should update to a kernel version that includes these fixes to prevent the NULL pointer dereference. No additional mitigation is required beyond applying the official patch.

Description

CVE-2026-53237 is a vulnerability in the Linux kernel's gpio mvebu driver where a NULL pointer dereference occurs during suspend/resume operations. The issue arises because the suspend and resume functions are called for all GPIO banks, but some banks lack PWM functionality, resulting in a NULL pointer dereference when accessing PWM-related data. This flaw can cause kernel crashes during suspend or resume on affected systems.

Impact

This vulnerability can cause a kernel NULL pointer dereference leading to a kernel crash (oops) during system suspend or resume on affected Linux kernel versions. This results in system instability and potential denial of service on affected devices using the mvebu GPIO driver.

Summary

The Linux kernel gpio mvebu driver calls mvebu_pwm_suspend() and mvebu_pwm_resume() for all GPIO banks during suspend and resume. However, not all GPIO banks have PWM functionality, and for those without PWM, the mvchip->mvpwm pointer is NULL. Calling these functions with a NULL mvpwm pointer leads to a NULL pointer dereference when the code attempts to access mvpwm->blink_select, causing a kernel oops and crash. The issue is fixed by adding a NULL check for mvchip->mvpwm before invoking the PWM suspend/resume functions.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 30 Oct 2026, 12:35 UTC

Technical details

References

Community reviews

Related threats