CVE-2026-53237

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

gpio: mvebu: fix NULL pointer dereference in suspend/resume

mvebu_pwm_suspend() and mvebu_pwm_resume() are called for all GPIO

banks during suspend/resume, but not all banks have PWM functionality.

GPIO banks without PWM have mvchip->mvpwm set to NULL.

Calling mvebu_pwm_suspend() with mvpwm == NULL causes a NULL pointer

dereference when it tries to access mvpwm->blink_select.

Unable to handle kernel NULL pointer dereference at virtual address 00000020 when write

[00000020] *pgd=00000000

Internal error: Oops: 815 [#1] PREEMPT ARM

Modules linked in:

CPU: 0 UID: 0 PID: 406 Comm: sh Not tainted 6.12.74-rt12-yocto-standard-g4e96f98fb7db-dirty #353

Hardware name: Marvell Armada 370/XP (Device Tree)

PC is at regmap_mmio_read+0x38/0x54

LR is at regmap_mmio_read+0x38/0x54

pc : [<c05fd2ac>] lr : [<c05fd2ac>] psr: 200f0013

sp : f0c11d10 ip : 00000000 fp : c100d2f0

r10: c14fb854 r9 : 00000000 r8

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References