CVE-2023-52893: Linux Kernel

Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: gsmi: fix null-deref in gsmi_get_variable We can get EFI variables without fetching the attribute, so we must allow for that in gsmi. commit 859748255b43 ("efi: pstore: Omit efivars caching EFI varstore access layer") added a new get_variable call with attr=NULL, which triggers panic in gsmi.

Affected products

• Linux Linux Kernel: from 3.0, before 4.14.304 (fixed in 4.14.304); from 4.15, before 4.19.271 (fixed in 4.19.271); from 4.20, before 5.4.230 (fixed in 5.4.230); from 5.5, before 5.10.165 (fixed in 5.10.165); from 5.11, before 5.15.90 (fixed in 5.15.90); from 5.16, before 6.1.8 (fixed in 6.1.8); …

Published 2024-08-21. Last modified 2026-06-17.