{"id":"CVE-2023-54118","summary":"serial: sc16is7xx: setup GPIO controller later in probe","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nserial: sc16is7xx: setup GPIO controller later in probe\n\nThe GPIO controller component of the sc16is7xx driver is setup too\nearly, which can result in a race condition where another device tries\nto utilise the GPIO lines before the sc16is7xx device has finished\ninitialising.\n\nThis issue manifests itself as an Oops when the GPIO lines are configured:\n\n    Unable to handle kernel read from unreadable memory at virtual address\n    ...\n    pc : sc16is7xx_gpio_direction_output+0x68/0x108 [sc16is7xx]\n    lr : sc16is7xx_gpio_direction_output+0x4c/0x108 [sc16is7xx]\n    ...\n    Call trace:\n    sc16is7xx_gpio_direction_output+0x68/0x108 [sc16is7xx]\n    gpiod_direction_output_raw_commit+0x64/0x318\n    gpiod_direction_output+0xb0/0x170\n    create_gpio_led+0xec/0x198\n    gpio_led_probe+0x16c/0x4f0\n    platform_drv_probe+0x5c/0xb0\n    really_probe+0xe8/0x448\n    driver_probe_device+0xe8/0x138\n    __device_attach_driver+0x94/0x118\n    bus_for_each_drv+0x8c/0xe0\n    __device_attach+0x100/0x1b8\n    device_initial_probe+0x28/0x38\n    bus_probe_device+0xa4/0xb0\n    deferred_probe_work_func+0x90/0xe0\n    process_one_work+0x1c4/0x480\n    worker_thread+0x54/0x430\n    kthread+0x138/0x150\n    ret_from_fork+0x10/0x1c\n\nThis patch moves the setup of the GPIO controller functions to later in the\nprobe function, ensuring the sc16is7xx device has already finished\ninitialising by the time other devices try to make use of the GPIO lines.\nThe error handling has also been reordered to reflect the new\ninitialisation order.","modified":"2026-04-02T09:45:36.217511Z","published":"2025-12-24T13:06:38.998Z","related":["SUSE-SU-2026:0263-1","SUSE-SU-2026:0317-1","SUSE-SU-2026:0411-1","SUSE-SU-2026:0473-1","SUSE-SU-2026:0617-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/54xxx/CVE-2023-54118.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/17b96b5c19bec791b433890549e44ca523dc82aa"},{"type":"WEB","url":"https://git.kernel.org/stable/c/49b326ce8a686428d8cbb82ed74fc88ed3f95a51"},{"type":"WEB","url":"https://git.kernel.org/stable/c/b71ff206707855ce73c04794c76f7b678b2d4f72"},{"type":"WEB","url":"https://git.kernel.org/stable/c/c8f71b49ee4d28930c4a6798d1969fa91dc4ef3e"},{"type":"WEB","url":"https://git.kernel.org/stable/c/f57c2164d082a36d177ab7fbf54c18970df89c22"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/54xxx/CVE-2023-54118.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-54118"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"dfeae619d781dee61666d5551b93ba3be755a86b"},{"fixed":"17b96b5c19bec791b433890549e44ca523dc82aa"},{"fixed":"49b326ce8a686428d8cbb82ed74fc88ed3f95a51"},{"fixed":"f57c2164d082a36d177ab7fbf54c18970df89c22"},{"fixed":"b71ff206707855ce73c04794c76f7b678b2d4f72"},{"fixed":"c8f71b49ee4d28930c4a6798d1969fa91dc4ef3e"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-54118.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.16.0"},{"fixed":"5.10.173"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.100"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.18"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.2.5"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-54118.json"}}],"schema_version":"1.7.5"}