{"id":"CVE-2023-53310","summary":"power: supply: axp288_fuel_gauge: Fix external_power_changed race","details":"In the Linux kernel, the following vulnerability has been resolved:\n\npower: supply: axp288_fuel_gauge: Fix external_power_changed race\n\nfuel_gauge_external_power_changed() dereferences info-\u003ebat,\nwhich gets sets in axp288_fuel_gauge_probe() like this:\n\n  info-\u003ebat = devm_power_supply_register(dev, &fuel_gauge_desc, &psy_cfg);\n\nAs soon as devm_power_supply_register() has called device_add()\nthe external_power_changed callback can get called. So there is a window\nwhere fuel_gauge_external_power_changed() may get called while\ninfo-\u003ebat has not been set yet leading to a NULL pointer dereference.\n\nFixing this is easy. The external_power_changed callback gets passed\nthe power_supply which will eventually get stored in info-\u003ebat,\nso fuel_gauge_external_power_changed() can simply directly use\nthe passed in psy argument which is always valid.","modified":"2026-08-12T03:51:30.728406388Z","published":"2025-09-16T16:11:48.399Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53310.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/0456b912121e45b3ef54abe3135e5dcb541f956c"},{"type":"WEB","url":"https://git.kernel.org/stable/c/a636c6ba9ce898207f283271cb28511206ab739b"},{"type":"WEB","url":"https://git.kernel.org/stable/c/f8319774d6f1567d6e7d03653174ab0c82c5c66d"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53310.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-53310"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"30abb3d07929137bf72327560e1595508a692c4e"},{"fixed":"0456b912121e45b3ef54abe3135e5dcb541f956c"},{"fixed":"a636c6ba9ce898207f283271cb28511206ab739b"},{"fixed":"f8319774d6f1567d6e7d03653174ab0c82c5c66d"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-53310.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.18.0"},{"fixed":"6.1.31"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.3.5"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-53310.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}