---
id: CVE-2023-53561
title: 'net: wwan: iosm: fix NULL pointer dereference when removing device'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net: wwan: iosm: fix NULL pointer dereference when removing device

  In suspend and resume cycle, the removal and rescan of device ends
  up in NULL pointer dereference.

  …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 3670970dd8c661c10c10c300d726f59428eaad32 <
    ee44bacf462db3ec6e4f0dcfa7931e768670d77c
  - >-
    Linux >= 3670970dd8c661c10c10c300d726f59428eaad32 <
    862c6e3e26735247d8a4df41fa2421909c3f4d63
  - >-
    Linux >= 3670970dd8c661c10c10c300d726f59428eaad32 <
    60829145f1e2650b31ebe6a0ec70a9725b38fa2c
  - Linux 5.14
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T20:23:44.862391Z'
published: '2025-10-04'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T20:31:14.735Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2023-53561'
references:
  - url: 'https://git.kernel.org/stable/c/ee44bacf462db3ec6e4f0dcfa7931e768670d77c'
  - url: 'https://git.kernel.org/stable/c/862c6e3e26735247d8a4df41fa2421909c3f4d63'
  - url: 'https://git.kernel.org/stable/c/60829145f1e2650b31ebe6a0ec70a9725b38fa2c'
tags:
  - cve.org
epss: 0.00146
epssPercentile: 0.03879
ingestedAt: '2026-11-05T22:38:31.809Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net: wwan: iosm: fix NULL pointer dereference when removing device

In suspend and resume cycle, the removal and rescan of device ends
up in NULL pointer dereference.

During driver initialization, if the ipc_imem_wwan_channel_init()
fails to get the valid device capabilities it returns an error and
further no resource (wwan struct) will be allocated. Now in this
situation if driver removal procedure is initiated it would result
in NULL pointer exception since unallocated wwan struct is dereferenced
inside ipc_wwan_deinit().

ipc_imem_run_state_worker() to handle the called functions return value
and to release the resource in failure case. It also reports the link
down event in failure cases. The user space application can handle this
event to do a device reset for restoring the device communication.

## Affected

- `Linux >= 3670970dd8c661c10c10c300d726f59428eaad32 < ee44bacf462db3ec6e4f0dcfa7931e768670d77c`
- `Linux >= 3670970dd8c661c10c10c300d726f59428eaad32 < 862c6e3e26735247d8a4df41fa2421909c3f4d63`
- `Linux >= 3670970dd8c661c10c10c300d726f59428eaad32 < 60829145f1e2650b31ebe6a0ec70a9725b38fa2c`
- `Linux 5.14`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.