CVE-2026-53237 Overview
CVE-2026-53237 is a NULL pointer dereference vulnerability in the Linux kernel's Marvell EBU (mvebu) GPIO driver. The flaw exists in the mvebu_pwm_suspend() and mvebu_pwm_resume() functions, which the kernel invokes for all GPIO banks during system suspend and resume operations. GPIO banks without PWM functionality have mvchip->mvpwm set to NULL. When the suspend path dereferences this pointer to access mvpwm->blink_select, the kernel triggers an Oops and crashes. The issue affects systems using Marvell Armada 370/XP and related platforms running affected Linux kernel versions.
Critical Impact
Local triggering of system suspend on affected Marvell hardware causes a kernel NULL pointer dereference, resulting in denial of service.
Affected Products
- Linux kernel gpio-mvebu driver on Marvell Armada 370/XP and related SoCs
- Stable Linux kernel branches prior to the commits referenced in the kernel.org fix series
- Embedded and industrial systems using Marvell EBU GPIO with mixed PWM/non-PWM banks
Discovery Timeline
- 2026-06-25 - CVE-2026-53237 published to NVD
- 2026-06-25 - Last updated in NVD database
Technical Details for CVE-2026-53237
Vulnerability Analysis
The Linux kernel's mvebu GPIO driver registers suspend and resume callbacks that iterate across every GPIO bank on the SoC. The callbacks invoke mvebu_pwm_suspend() and mvebu_pwm_resume() unconditionally, assuming each bank exposes PWM capabilities. On Marvell platforms, only a subset of GPIO banks support PWM, and the driver leaves mvchip->mvpwm as NULL for banks without that hardware block.
During suspend, the unconditional path dereferences mvpwm->blink_select and issues a regmap_read against the NULL-backed register map. The kernel call trace shows the crash originating in regmap_mmio_read+0x38/0x54, called from mvebu_gpio_suspend+0xa4/0x14c, propagating through dpm_run_callback and device_suspend. The result is a kernel Oops at virtual address 0x00000020, which corresponds to the blink_select field offset within the NULL mvpwm structure.
Root Cause
The root cause is a missing NULL check on mvchip->mvpwm before the suspend and resume helpers access PWM-specific state. The driver treats PWM availability as universal across banks but allocates the mvpwm structure only for banks that declare PWM support. This is a classic Null Pointer Dereference [CWE-476] in a kernel power-management path.
Attack Vector
Triggering the fault requires the ability to initiate a system suspend on affected hardware, such as writing mem to /sys/power/state. The provided crash trace shows the bug reached via state_store from a shell write, indicating a local, low-privilege path on systems where suspend is permitted. The vulnerability does not provide code execution but produces a reliable kernel crash, blocking suspend functionality and potentially impacting availability on long-running embedded deployments.
The upstream fix adds a NULL check for mvchip->mvpwm before calling the PWM suspend and resume helpers. See the Kernel Git Commit 4ef24338 and the Kernel Git Commit c9677a92 for the patch series.
Detection Methods for CVE-2026-53237
Indicators of Compromise
- Kernel Oops messages referencing regmap_mmio_read called from mvebu_gpio_suspend or mvebu_gpio_resume
- Crash signature Unable to handle kernel NULL pointer dereference at virtual address 00000020
- Failed transitions to mem sleep state on Marvell Armada 370/XP devices logged via dmesg
Detection Strategies
- Inventory Linux assets running Marvell EBU SoCs and compare running kernel versions against the fixed stable branches listed in the kernel.org commits
- Parse /var/log/kern.log and journald entries for the specific call trace through mvebu_gpio_suspend and dpm_run_callback
- Correlate unexpected reboots on embedded devices with power-management events in centralized logging
Monitoring Recommendations
- Forward kernel logs from embedded Linux endpoints to a centralized log platform for retention and pattern matching
- Alert on any kernel Oops or panic events originating in GPIO or power-management subsystems
- Track suspend success and failure rates on fleets of identical Marvell-based devices to surface regressions early
How to Mitigate CVE-2026-53237
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the kernel.org commits to the affected stable branches
- Rebuild and deploy kernels for any Marvell Armada 370/XP or related EBU-based devices in production
- Restrict access to /sys/power/state so only privileged management processes can initiate suspend until patches are deployed
Patch Information
The fix is distributed across the stable kernel tree in the following commits: Kernel Git Commit 4ef24338, Kernel Git Commit 6136c147, Kernel Git Commit 7db09011, Kernel Git Commit b9ad50d7, and Kernel Git Commit c9677a92. Each commit adds a NULL check for mvchip->mvpwm before invoking the PWM suspend and resume helpers.
Workarounds
- Disable system suspend on affected devices by configuring init systems to refuse mem sleep transitions until patched kernels are available
- Tighten permissions on /sys/power/state so that only root-owned services with explicit need can write to it
- For appliances that do not rely on suspend, build kernels with PM suspend support disabled to remove the vulnerable code path
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
