CVE-2023-53054 (GCVE-0-2023-53054)

Vulnerability from cvelistv5 – Published: 2025-05-02 15:55 – Updated: 2026-05-23 15:27
VLAI
Title
usb: dwc2: fix a devres leak in hw_enable upon suspend resume
Summary
In the Linux kernel, the following vulnerability has been resolved: usb: dwc2: fix a devres leak in hw_enable upon suspend resume Each time the platform goes to low power, PM suspend / resume routines call: __dwc2_lowlevel_hw_enable -> devm_add_action_or_reset(). This adds a new devres each time. This may also happen at runtime, as dwc2_lowlevel_hw_enable() can be called from udc_start(). This can be seen with tracing: - echo 1 > /sys/kernel/debug/tracing/events/dev/devres_log/enable - go to low power - cat /sys/kernel/debug/tracing/trace A new "ADD" entry is found upon each low power cycle: ... devres_log: 49000000.usb-otg ADD 82a13bba devm_action_release (8 bytes) ... devres_log: 49000000.usb-otg ADD 49889daf devm_action_release (8 bytes) ... A second issue is addressed here: - regulator_bulk_enable() is called upon each PM cycle (suspend/resume). - regulator_bulk_disable() never gets called. So the reference count for these regulators constantly increase, by one upon each low power cycle, due to missing regulator_bulk_disable() call in __dwc2_lowlevel_hw_disable(). The original fix that introduced the devm_add_action_or_reset() call, fixed an issue during probe, that happens due to other errors in dwc2_driver_probe() -> dwc2_core_reset(). Then the probe fails without disabling regulators, when dr_mode == USB_DR_MODE_PERIPHERAL. Rather fix the error path: disable all the low level hardware in the error path, by using the "hsotg->ll_hw_enabled" flag. Checking dr_mode has been introduced to avoid a dual call to dwc2_lowlevel_hw_disable(). "ll_hw_enabled" should achieve the same (and is used currently in the remove() routine).
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 33a06f1300a79cfd461cea0268f05e969d4f34ec , < 1f01027c51eb16145e8e07fafea3ca07ef102d06 (git)
Affected: 33a06f1300a79cfd461cea0268f05e969d4f34ec , < cba76e1fb896b573f09f51aa299223276a77bc90 (git)
Affected: 33a06f1300a79cfd461cea0268f05e969d4f34ec , < ffb8ab6f87bd28d700ab5c20d9d3a7e75067630d (git)
Affected: 33a06f1300a79cfd461cea0268f05e969d4f34ec , < 6485fc381b6528b6f547ee1ff10bdbcbe31a6e4c (git)
Affected: 33a06f1300a79cfd461cea0268f05e969d4f34ec , < f747313249b74f323ddf841a9c8db14d989f296a (git)
Affected: c95e1f67b9a84479d1a6d2e9b123a1553af2a75e (git)
Affected: 7d2a4749e1589295c69183f7d79d5b62664b34d6 (git)
Affected: 8a8841b9f3eb1f46e3fc6d56a9b9299c53f4f86f (git)
Affected: fa7fd9ba18533e9aa5f718a06de3deb522a4b587 (git)
Affected: b2c2b88b049684b89776036f9a03fcc2d1bb3c22 (git)
Affected: e7c4b79d70a70b4b7b0a04c640238a2ef0a7a8c8 (git)
Affected: 88dcd13872b11bd60e6d4cb6317821e1d367e524 (git)
Affected: 4.4.233 , < 4.5 (semver)
Affected: 4.9.233 , < 4.10 (semver)
Affected: 4.14.194 , < 4.15 (semver)
Affected: 4.19.140 , < 4.20 (semver)
Affected: 5.4.59 , < 5.5 (semver)
Affected: 5.7.16 , < 5.8 (semver)
Affected: 5.8.2 , < 5.9 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 5.9
Unaffected: 0 , < 5.9 (semver)
Unaffected: 5.10.177 , ≤ 5.10.* (semver)
Unaffected: 5.15.105 , ≤ 5.15.* (semver)
Unaffected: 6.1.22 , ≤ 6.1.* (semver)
Unaffected: 6.2.9 , ≤ 6.2.* (semver)
Unaffected: 6.3 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/dwc2/platform.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1f01027c51eb16145e8e07fafea3ca07ef102d06",
              "status": "affected",
              "version": "33a06f1300a79cfd461cea0268f05e969d4f34ec",
              "versionType": "git"
            },
            {
              "lessThan": "cba76e1fb896b573f09f51aa299223276a77bc90",
              "status": "affected",
              "version": "33a06f1300a79cfd461cea0268f05e969d4f34ec",
              "versionType": "git"
            },
            {
              "lessThan": "ffb8ab6f87bd28d700ab5c20d9d3a7e75067630d",
              "status": "affected",
              "version": "33a06f1300a79cfd461cea0268f05e969d4f34ec",
              "versionType": "git"
            },
            {
              "lessThan": "6485fc381b6528b6f547ee1ff10bdbcbe31a6e4c",
              "status": "affected",
              "version": "33a06f1300a79cfd461cea0268f05e969d4f34ec",
              "versionType": "git"
            },
            {
              "lessThan": "f747313249b74f323ddf841a9c8db14d989f296a",
              "status": "affected",
              "version": "33a06f1300a79cfd461cea0268f05e969d4f34ec",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c95e1f67b9a84479d1a6d2e9b123a1553af2a75e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "7d2a4749e1589295c69183f7d79d5b62664b34d6",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8a8841b9f3eb1f46e3fc6d56a9b9299c53f4f86f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "fa7fd9ba18533e9aa5f718a06de3deb522a4b587",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b2c2b88b049684b89776036f9a03fcc2d1bb3c22",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e7c4b79d70a70b4b7b0a04c640238a2ef0a7a8c8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "88dcd13872b11bd60e6d4cb6317821e1d367e524",
              "versionType": "git"
            },
            {
              "lessThan": "4.5",
              "status": "affected",
              "version": "4.4.233",
              "versionType": "semver"
            },
            {
              "lessThan": "4.10",
              "status": "affected",
              "version": "4.9.233",
              "versionType": "semver"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.194",
              "versionType": "semver"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.140",
              "versionType": "semver"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.59",
              "versionType": "semver"
            },
            {
              "lessThan": "5.8",
              "status": "affected",
              "version": "5.7.16",
              "versionType": "semver"
            },
            {
              "lessThan": "5.9",
              "status": "affected",
              "version": "5.8.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/dwc2/platform.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.9"
            },
            {
              "lessThan": "5.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.177",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.105",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.22",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.2.*",
              "status": "unaffected",
              "version": "6.2.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.177",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.105",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.22",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2.9",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.4.233",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.9.233",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.14.194",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.140",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.59",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.7.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.8.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc2: fix a devres leak in hw_enable upon suspend resume\n\nEach time the platform goes to low power, PM suspend / resume routines\ncall: __dwc2_lowlevel_hw_enable -\u003e devm_add_action_or_reset().\nThis adds a new devres each time.\nThis may also happen at runtime, as dwc2_lowlevel_hw_enable() can be\ncalled from udc_start().\n\nThis can be seen with tracing:\n- echo 1 \u003e /sys/kernel/debug/tracing/events/dev/devres_log/enable\n- go to low power\n- cat /sys/kernel/debug/tracing/trace\n\nA new \"ADD\" entry is found upon each low power cycle:\n... devres_log: 49000000.usb-otg ADD 82a13bba devm_action_release (8 bytes)\n... devres_log: 49000000.usb-otg ADD 49889daf devm_action_release (8 bytes)\n...\n\nA second issue is addressed here:\n- regulator_bulk_enable() is called upon each PM cycle (suspend/resume).\n- regulator_bulk_disable() never gets called.\n\nSo the reference count for these regulators constantly increase, by one\nupon each low power cycle, due to missing regulator_bulk_disable() call\nin __dwc2_lowlevel_hw_disable().\n\nThe original fix that introduced the devm_add_action_or_reset() call,\nfixed an issue during probe, that happens due to other errors in\ndwc2_driver_probe() -\u003e dwc2_core_reset(). Then the probe fails without\ndisabling regulators, when dr_mode == USB_DR_MODE_PERIPHERAL.\n\nRather fix the error path: disable all the low level hardware in the\nerror path, by using the \"hsotg-\u003ell_hw_enabled\" flag. Checking dr_mode\nhas been introduced to avoid a dual call to dwc2_lowlevel_hw_disable().\n\"ll_hw_enabled\" should achieve the same (and is used currently in the\nremove() routine)."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T15:27:49.928Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1f01027c51eb16145e8e07fafea3ca07ef102d06"
        },
        {
          "url": "https://git.kernel.org/stable/c/cba76e1fb896b573f09f51aa299223276a77bc90"
        },
        {
          "url": "https://git.kernel.org/stable/c/ffb8ab6f87bd28d700ab5c20d9d3a7e75067630d"
        },
        {
          "url": "https://git.kernel.org/stable/c/6485fc381b6528b6f547ee1ff10bdbcbe31a6e4c"
        },
        {
          "url": "https://git.kernel.org/stable/c/f747313249b74f323ddf841a9c8db14d989f296a"
        }
      ],
      "title": "usb: dwc2: fix a devres leak in hw_enable upon suspend resume",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53054",
    "datePublished": "2025-05-02T15:55:09.354Z",
    "dateReserved": "2025-05-02T15:51:43.546Z",
    "dateUpdated": "2026-05-23T15:27:49.928Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-53054",
      "date": "2026-09-27",
      "epss": "0.00197",
      "percentile": "0.08442"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/usb/dwc2/platform.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "1f01027c51eb16145e8e07fafea3ca07ef102d06",
                    "status": "affected",
                    "version": "33a06f1300a79cfd461cea0268f05e969d4f34ec",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "cba76e1fb896b573f09f51aa299223276a77bc90",
                    "status": "affected",
                    "version": "33a06f1300a79cfd461cea0268f05e969d4f34ec",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ffb8ab6f87bd28d700ab5c20d9d3a7e75067630d",
                    "status": "affected",
                    "version": "33a06f1300a79cfd461cea0268f05e969d4f34ec",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6485fc381b6528b6f547ee1ff10bdbcbe31a6e4c",
                    "status": "affected",
                    "version": "33a06f1300a79cfd461cea0268f05e969d4f34ec",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f747313249b74f323ddf841a9c8db14d989f296a",
                    "status": "affected",
                    "version": "33a06f1300a79cfd461cea0268f05e969d4f34ec",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "c95e1f67b9a84479d1a6d2e9b123a1553af2a75e",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "7d2a4749e1589295c69183f7d79d5b62664b34d6",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "8a8841b9f3eb1f46e3fc6d56a9b9299c53f4f86f",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "fa7fd9ba18533e9aa5f718a06de3deb522a4b587",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "b2c2b88b049684b89776036f9a03fcc2d1bb3c22",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "e7c4b79d70a70b4b7b0a04c640238a2ef0a7a8c8",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "88dcd13872b11bd60e6d4cb6317821e1d367e524",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4.5",
                    "status": "affected",
                    "version": "4.4.233",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "4.10",
                    "status": "affected",
                    "version": "4.9.233",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "4.15",
                    "status": "affected",
                    "version": "4.14.194",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "4.20",
                    "status": "affected",
                    "version": "4.19.140",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "5.5",
                    "status": "affected",
                    "version": "5.4.59",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "5.8",
                    "status": "affected",
                    "version": "5.7.16",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "5.9",
                    "status": "affected",
                    "version": "5.8.2",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/usb/dwc2/platform.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.9"
                  },
                  {
                    "lessThan": "5.9",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.177",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.105",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.22",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.2.*",
                    "status": "unaffected",
                    "version": "6.2.9",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.3",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8B4E143B-22A3-4A08-963A-D5E42624F2E9",
                    "versionEndExcluding": "4.5",
                    "versionStartIncluding": "4.4.233",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "5CABC2BE-6BAD-4283-89B2-D98A50976680",
                    "versionEndExcluding": "4.10",
                    "versionStartIncluding": "4.9.233",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "754AC47E-9FCE-4357-9717-F625B68662FB",
                    "versionEndExcluding": "4.15",
                    "versionStartIncluding": "4.14.194",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "672D57CA-6B11-4A62-A86A-7E310B74C321",
                    "versionEndExcluding": "4.20",
                    "versionStartIncluding": "4.19.140",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FAC905ED-E26D-4E98-9EA6-F9162C3B259C",
                    "versionEndExcluding": "5.5",
                    "versionStartIncluding": "5.4.59",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "ED553EDD-0029-44FB-ABF4-87D601D3D1AD",
                    "versionEndExcluding": "5.8",
                    "versionStartIncluding": "5.7.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "214C9267-488A-4796-A952-350A69F24905",
                    "versionEndExcluding": "5.10.177",
                    "versionStartIncluding": "5.8.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "0888AE70-CB0A-45C0-B9BD-A5371244C8DB",
                    "versionEndExcluding": "5.15.105",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "642B6F99-95C6-47F5-A9B1-5C45FE08CAD0",
                    "versionEndExcluding": "6.1.22",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "914F22DD-1E6F-4B0A-A14D-3A9F068F6761",
                    "versionEndExcluding": "6.2.9",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.3:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "B8E3B0E8-FA27-4305-87BB-AF6C25B160CB",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.3:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "A47F0FC3-CE52-4BA1-BA51-22F783938431",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.3:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "3583026A-27EC-4A4C-850A-83F2AF970673",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc2: fix a devres leak in hw_enable upon suspend resume\n\nEach time the platform goes to low power, PM suspend / resume routines\ncall: __dwc2_lowlevel_hw_enable -\u003e devm_add_action_or_reset().\nThis adds a new devres each time.\nThis may also happen at runtime, as dwc2_lowlevel_hw_enable() can be\ncalled from udc_start().\n\nThis can be seen with tracing:\n- echo 1 \u003e /sys/kernel/debug/tracing/events/dev/devres_log/enable\n- go to low power\n- cat /sys/kernel/debug/tracing/trace\n\nA new \"ADD\" entry is found upon each low power cycle:\n... devres_log: 49000000.usb-otg ADD 82a13bba devm_action_release (8 bytes)\n... devres_log: 49000000.usb-otg ADD 49889daf devm_action_release (8 bytes)\n...\n\nA second issue is addressed here:\n- regulator_bulk_enable() is called upon each PM cycle (suspend/resume).\n- regulator_bulk_disable() never gets called.\n\nSo the reference count for these regulators constantly increase, by one\nupon each low power cycle, due to missing regulator_bulk_disable() call\nin __dwc2_lowlevel_hw_disable().\n\nThe original fix that introduced the devm_add_action_or_reset() call,\nfixed an issue during probe, that happens due to other errors in\ndwc2_driver_probe() -\u003e dwc2_core_reset(). Then the probe fails without\ndisabling regulators, when dr_mode == USB_DR_MODE_PERIPHERAL.\n\nRather fix the error path: disable all the low level hardware in the\nerror path, by using the \"hsotg-\u003ell_hw_enabled\" flag. Checking dr_mode\nhas been introduced to avoid a dual call to dwc2_lowlevel_hw_disable().\n\"ll_hw_enabled\" should achieve the same (and is used currently in the\nremove() routine)."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: usb: dwc2: se corrige una fuga de devres en hw_enable al reanudar la suspensi\u00f3n. Cada vez que la plataforma pasa a bajo consumo, las rutinas de suspensi\u00f3n/reinicio de PM llaman a __dwc2_lowlevel_hw_enable -\u0026gt; devm_add_action_or_reset(). Esto agrega un nuevo devres cada vez. Esto tambi\u00e9n puede ocurrir en tiempo de ejecuci\u00f3n, ya que dwc2_lowlevel_hw_enable() puede llamarse desde udc_start(). Esto se puede ver con el seguimiento: - echo 1 \u0026gt; /sys/kernel/debug/tracing/events/dev/devres_log/enable - ir a bajo consumo - cat /sys/kernel/debug/tracing/trace Se encuentra una nueva entrada \"ADD\" en cada ciclo de bajo consumo: ... devres_log: 49000000.usb-otg ADD 82a13bba devm_action_release (8 bytes) ... devres_log: 49000000.usb-otg ADD 49889daf devm_action_release (8 bytes) ... Aqu\u00ed se aborda un segundo problema: - regulator_bulk_enable() se llama en cada ciclo de PM (suspender/reanudar). - regulator_bulk_disable() nunca se llama. Por lo tanto, el recuento de referencias para estos reguladores aumenta constantemente, en uno con cada ciclo de bajo consumo, debido a la falta de la llamada a regulator_bulk_disable() en __dwc2_lowlevel_hw_disable(). La correcci\u00f3n original, que introdujo la llamada a devm_add_action_or_reset(), solucion\u00f3 un problema durante el sondeo que se produce debido a otros errores en dwc2_driver_probe() -\u0026gt; dwc2_core_reset(). En ese caso, el sondeo falla sin deshabilitar los reguladores cuando dr_mode == USB_DR_MODE_PERIPHERAL. Mejor soluci\u00f3n: deshabilite todo el hardware de bajo nivel en la ruta de error mediante el indicador \"hsotg-\u0026gt;ll_hw_enabled\". Se ha introducido la comprobaci\u00f3n de dr_mode para evitar una llamada dual a dwc2_lowlevel_hw_disable(). \"ll_hw_enabled\" deber\u00eda lograr el mismo efecto (y se utiliza actualmente en la rutina remove())."
          }
        ],
        "id": "CVE-2023-53054",
        "lastModified": "2026-06-17T06:44:12.470",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2025-05-02T16:15:24.483",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/1f01027c51eb16145e8e07fafea3ca07ef102d06"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/6485fc381b6528b6f547ee1ff10bdbcbe31a6e4c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/cba76e1fb896b573f09f51aa299223276a77bc90"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/f747313249b74f323ddf841a9c8db14d989f296a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/ffb8ab6f87bd28d700ab5c20d9d3a7e75067630d"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-401"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-29T23:15:19+00:00",
      "cve": "CVE-2023-53054",
      "id": "CVE-2023-53054",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: usb: dwc2: fix a devres leak in hw_enable upon suspend resume",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-53054.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-31T01:01:41Z",
      "cve": "CVE-2023-53054",
      "id": "CVE-2023-53054",
      "initial_release_date": "2025-05-03T02:51:34Z",
      "product_status:known_affected": "408",
      "product_status:known_not_affected": "315",
      "product_status:recommended": "214",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-53054",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-53054.json",
      "version": "35"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.