CVE-2023-52984

net: phy: dp83822: Fix null pointer access on DP83825/DP83826 devices

State: Published
Severity: 5.5 Medium
Published: Mar 27, 2025
Updated: May 11, 2026
Reserved: Mar 27, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

net: phy: dp83822: Fix null pointer access on DP83825/DP83826 devices

The probe() function is only used for the DP83822 PHY, leaving the private data pointer uninitialized for the smaller DP83825/26 models. While all uses of the private data structure are hidden in 82822 specific callbacks, configuring the interrupt is shared across all models. This causes a NULL pointer dereference on the smaller PHYs as it accesses the private data unchecked. Verifying the pointer avoids that.

Scores

CVSS	Score	Vector	Source
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

CWE-476 NULL Pointer Dereference

Affected Products

Product	Versions
LinuxLinux	5dc39fd5ef35bc6919759fa99246581b1adc6b82 to before 362a2f5531dc0e5b0b5b3e3a541000dbffa75461Affected 5dc39fd5ef35bc6919759fa99246581b1adc6b82 to before 2cd1e9c013ec56421c58921b1ddf1d2d53bd47faAffected 5dc39fd5ef35bc6919759fa99246581b1adc6b82 to before 78901b10522cdf6badf24acf65a892637596bcccAffected 5dc39fd5ef35bc6919759fa99246581b1adc6b82 to before 422ae7d9c7221e8d4c8526d0f54106307d69d2dcAffected
LinuxLinux	5.10Affected before 5.10Not affected 5.10.168 through 5.10.Not affected 5.15.93 through 5.15.Not affected 6.1.11 through 6.1.*Not affected 6.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.