{"cve":"CVE-2023-53834","nvd":{"published":"2025-12-09T16:17:22.680","modified":"2026-06-17T06:46:09.260","status":"Deferred","description":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: adc: ina2xx: avoid NULL pointer dereference on OF device match\n\nThe affected lines were resulting in a NULL pointer dereference on our\nplatform because the device tree contained the following list of\ncompatible strings:\n\n    power-sensor@40 {\n        compatible = \"ti,ina232\", \"ti,ina231\";\n        ...\n    };\n\nSince the driver doesn't declare a compatible string \"ti,ina232\", the OF\nmatching succeeds on \"ti,ina231\". But the I2C device ID info is\npopulated via the first compatible string, cf. modalias population in\nof_i2c_get_board_info(). Since there is no \"ina232\" entry in the legacy\nI2C device ID table either, the struct i2c_device_id *id pointer in the\nprobe function is NULL.\n\nFix this by using the already populated type variable instead, which\npoints to the proper driver data. Since the name is also wanted, add a\ngeneric one to the ina2xx_config table.","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/13f3ce53b65aa8b44cad7039d31e62c9ffd6c5d1","https://git.kernel.org/stable/c/77b689cc27d489b75d33f1a368356d70eb0ce08c","https://git.kernel.org/stable/c/a41e19cc0d6b6a445a4133170b90271e4a2553dc","https://git.kernel.org/stable/c/a8e2ae6296d56478fb98ae7f739846ed121f154f"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:16:40.427100871+00:00"},"epss":{"cve":"CVE-2023-53834","score":0.00244,"percentile":0.15671,"date":"2026-11-01"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}