{"cve":"CVE-2023-53166","nvd":{"published":"2025-09-15T14:15:38.343","modified":"2026-06-17T06:44:25.533","status":"Analyzed","description":"In the Linux kernel, the following vulnerability has been resolved:\n\npower: supply: bq25890: Fix external_power_changed race\n\nbq25890_charger_external_power_changed() dereferences bq->charger,\nwhich gets sets in bq25890_power_supply_init() like this:\n\n  bq->charger = devm_power_supply_register(bq->dev, &bq->desc, &psy_cfg);\n\nAs soon as devm_power_supply_register() has called device_add()\nthe external_power_changed callback can get called. So there is a window\nwhere bq25890_charger_external_power_changed() may get called while\nbq->charger has not been set yet leading to a NULL pointer dereference.\n\nThis race hits during boot sometimes on a Lenovo Yoga Book 1 yb1-x90f\nwhen the cht_wcove_pwrsrc (extcon) power_supply is done with detecting\nthe connected charger-type which happens to exactly hit the small window:\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000018\n  <snip>\n  RIP: 0010:__power_supply_is_supplied_by+0xb/0xb0\n  <snip>\n  Call Trace:\n   <TASK>\n   __power_supply_get_supplier_property+0x19/0x50\n   class_for_each_device+0xb1/0xe0\n   power_supply_get_property_from_supplier+0x2e/0x50\n   bq25890_charger_external_power_changed+0x38/0x1b0 [bq25890_charger]\n   __power_supply_changed_work+0x30/0x40\n   class_for_each_device+0xb1/0xe0\n   power_supply_changed_work+0x5f/0xe0\n  <snip>\n\nFixing this is easy. The external_power_changed callback gets passed\nthe power_supply which will eventually get stored in bq->charger,\nso bq25890_charger_external_power_changed() can simply directly use\nthe passed in psy argument which is always valid.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","score":4.7},"cwes":["CWE-362"],"references":["https://git.kernel.org/stable/c/029a443b9b6424170f00f6dd5b7682e682cce92e","https://git.kernel.org/stable/c/72c28207c19c2c46fab8ae994aff25e197fb2949","https://git.kernel.org/stable/c/9d20fa1982c35697f3f8c4ae0f12791691ae5958"],"products":["linux:linux_kernel"],"source":"nvd","synced_at":"2026-10-19T22:08:41.295252406+00:00"},"epss":{"cve":"CVE-2023-53166","score":0.00112,"percentile":0.01377,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}