CVE-2023-54044

A NULL pointer dereference vulnerability was found in the Linux kernel's SPMI (System Power Management Interface) bus driver. When removing a SPMI driver that does not define a remove callback, spmi_drv_remove() dereferences a NULL function pointer, causing a kernel panic. This affects drivers using devm_() APIs that don't require explicit cleanup.

This flaw affects systems with Qualcomm SPMI PMIC hardware, primarily mobile and embedded platforms. The crash occurs during driver removal (module unload) when the SPMI driver lacks a remove callback. Drivers properly designed with devm_() managed resources legitimately may not need a remove callback, making this a framework bug.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.