CVE-2023-53580 (GCVE-0-2023-53580)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:43 – Updated: 2026-08-05 09:14
VLAI
EPSS
VEX
Title
USB: Gadget: core: Help prevent panic during UVC unconfigure
Summary
In the Linux kernel, the following vulnerability has been resolved:
USB: Gadget: core: Help prevent panic during UVC unconfigure
Avichal Rakesh reported a kernel panic that occurred when the UVC
gadget driver was removed from a gadget's configuration. The panic
involves a somewhat complicated interaction between the kernel driver
and a userspace component (as described in the Link tag below), but
the analysis did make one thing clear: The Gadget core should
accomodate gadget drivers calling usb_gadget_deactivate() as part of
their unbind procedure.
Currently this doesn't work. gadget_unbind_driver() calls
driver->unbind() while holding the udc->connect_lock mutex, and
usb_gadget_deactivate() attempts to acquire that mutex, which will
result in a deadlock.
The simple fix is for gadget_unbind_driver() to release the mutex when
invoking the ->unbind() callback. There is no particular reason for
it to be holding the mutex at that time, and the mutex isn't held
while the ->bind() callback is invoked. So we'll drop the mutex
before performing the unbind callback and reacquire it afterward.
We'll also add a couple of comments to usb_gadget_activate() and
usb_gadget_deactivate(). Because they run in process context they
must not be called from a gadget driver's ->disconnect() callback,
which (according to the kerneldoc for struct usb_gadget_driver in
include/linux/usb/gadget.h) may run in interrupt context. This may
help prevent similar bugs from arising in the future.
Severity
7.8 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
d8195536ce2624e2947d9f56b1a61e7a27874bd3 , < bed19d95fcb9c98dfaa9585922b39a2dfba7898d
(git)
Affected: 286d9975a838d0a54da049765fa1d1fb96b89682 , < 8c1edc00db65f6d4408b3d1cd845e8da3b9e0ca4 (git) Affected: 286d9975a838d0a54da049765fa1d1fb96b89682 , < 65dadb2beeb7360232b09ebc4585b54475dfee06 (git) Affected: 85102a45c7390caf124a3a5796574446f1e037b9 (git) Affected: 6.1.35 , < 6.1.46 (semver) Affected: 6.3.9 , < 6.4 (semver) |
guessed | |
| Linux | Linux |
Affected:
6.4
Unaffected: 0 , < 6.4 (semver) Unaffected: 6.1.46 , ≤ 6.1.* (semver) Unaffected: 6.4.11 , ≤ 6.4.* (semver) Unaffected: 6.5 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/udc/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bed19d95fcb9c98dfaa9585922b39a2dfba7898d",
"status": "affected",
"version": "d8195536ce2624e2947d9f56b1a61e7a27874bd3",
"versionType": "git"
},
{
"lessThan": "8c1edc00db65f6d4408b3d1cd845e8da3b9e0ca4",
"status": "affected",
"version": "286d9975a838d0a54da049765fa1d1fb96b89682",
"versionType": "git"
},
{
"lessThan": "65dadb2beeb7360232b09ebc4585b54475dfee06",
"status": "affected",
"version": "286d9975a838d0a54da049765fa1d1fb96b89682",
"versionType": "git"
},
{
"status": "affected",
"version": "85102a45c7390caf124a3a5796574446f1e037b9",
"versionType": "git"
},
{
"lessThan": "6.1.46",
"status": "affected",
"version": "6.1.35",
"versionType": "semver"
},
{
"lessThan": "6.4",
"status": "affected",
"version": "6.3.9",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/udc/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.4.*",
"status": "unaffected",
"version": "6.4.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.46",
"versionStartIncluding": "6.1.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.11",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.5",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.3.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: Gadget: core: Help prevent panic during UVC unconfigure\n\nAvichal Rakesh reported a kernel panic that occurred when the UVC\ngadget driver was removed from a gadget\u0027s configuration. The panic\ninvolves a somewhat complicated interaction between the kernel driver\nand a userspace component (as described in the Link tag below), but\nthe analysis did make one thing clear: The Gadget core should\naccomodate gadget drivers calling usb_gadget_deactivate() as part of\ntheir unbind procedure.\n\nCurrently this doesn\u0027t work. gadget_unbind_driver() calls\ndriver-\u003eunbind() while holding the udc-\u003econnect_lock mutex, and\nusb_gadget_deactivate() attempts to acquire that mutex, which will\nresult in a deadlock.\n\nThe simple fix is for gadget_unbind_driver() to release the mutex when\ninvoking the -\u003eunbind() callback. There is no particular reason for\nit to be holding the mutex at that time, and the mutex isn\u0027t held\nwhile the -\u003ebind() callback is invoked. So we\u0027ll drop the mutex\nbefore performing the unbind callback and reacquire it afterward.\n\nWe\u0027ll also add a couple of comments to usb_gadget_activate() and\nusb_gadget_deactivate(). Because they run in process context they\nmust not be called from a gadget driver\u0027s -\u003edisconnect() callback,\nwhich (according to the kerneldoc for struct usb_gadget_driver in\ninclude/linux/usb/gadget.h) may run in interrupt context. This may\nhelp prevent similar bugs from arising in the future."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Both halves of the bug are reached through local interfaces \u2014 V4L2 file operations on the UVC gadget\u0027s `/dev/videoX` node and gadget (re)configuration via configfs/driver model \u2014 not through USB bus traffic from a host or over a network.\nAC:L - The attacker controls one side of the race entirely (when to open/subscribe/close the V4L2 handle) and gets an explicit signal plus a ~1.5 s window (device-removal uevent followed by `uvc_function_unbind()`\u0027s 500 ms + 1000 ms timeouts), so the deadlock and subsequent use-after-free can be hit reliably and repeatedly.\nPR:L - An unprivileged local user with access to the UVC gadget video node (commonly group `video` on embedded, kiosk, and Android-derived devices) can hold the handle open and subscribed, which is all that is needed to turn gadget teardown into a deadlock and use-after-free; no root or capability is required on the attacking side.\nUI:N - Gadget unbind is driven by routine system events on affected devices (USB mode/role switches, cable-driven reconfiguration by system daemons, dwc3 DRD role change), not by a deliberate action of a separate victim user.\nS:U - The deadlock and the resulting use-after-free are confined to the kernel of the affected system; no VM, IOMMU, or other security-authority boundary is crossed.\nC:H - After the deadlock breaks, the release path operates on a destroyed workqueue and freed endpoint/request/descriptor objects; a local attacker who reclaims those allocations during the long, attacker-observable window obtains a kernel-memory read primitive.\nI:H - The same use-after-free \u2014 `cancel_work_sync()`/`queue_work()` on a freed `async_wq` and `usb_ep_dequeue()` on torn-down endpoints \u2014 dereferences attacker-groomable heap contents including function pointers, giving a write/control-flow-hijack primitive.\nA:H - The reported outcome is a kernel panic during UVC unconfigure, and the direct-call variant self-deadlocks on `udc-\u003econnect_lock` in uninterruptible state, permanently wedging the task and the entire USB gadget subsystem."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T09:14:56.489Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bed19d95fcb9c98dfaa9585922b39a2dfba7898d"
},
{
"url": "https://git.kernel.org/stable/c/8c1edc00db65f6d4408b3d1cd845e8da3b9e0ca4"
},
{
"url": "https://git.kernel.org/stable/c/65dadb2beeb7360232b09ebc4585b54475dfee06"
}
],
"title": "USB: Gadget: core: Help prevent panic during UVC unconfigure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53580",
"datePublished": "2025-10-04T15:43:57.064Z",
"dateReserved": "2025-10-04T15:14:15.926Z",
"dateUpdated": "2026-08-05T09:14:56.489Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2023-53580",
"date": "2026-09-14",
"epss": "0.00123",
"percentile": "0.02367"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2023-53580\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-10-04T16:15:53.713\",\"lastModified\":\"2026-08-04T10:19:13.120\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nUSB: Gadget: core: Help prevent panic during UVC unconfigure\\n\\nAvichal Rakesh reported a kernel panic that occurred when the UVC\\ngadget driver was removed from a gadget\u0027s configuration. The panic\\ninvolves a somewhat complicated interaction between the kernel driver\\nand a userspace component (as described in the Link tag below), but\\nthe analysis did make one thing clear: The Gadget core should\\naccomodate gadget drivers calling usb_gadget_deactivate() as part of\\ntheir unbind procedure.\\n\\nCurrently this doesn\u0027t work. gadget_unbind_driver() calls\\ndriver-\u003eunbind() while holding the udc-\u003econnect_lock mutex, and\\nusb_gadget_deactivate() attempts to acquire that mutex, which will\\nresult in a deadlock.\\n\\nThe simple fix is for gadget_unbind_driver() to release the mutex when\\ninvoking the -\u003eunbind() callback. There is no particular reason for\\nit to be holding the mutex at that time, and the mutex isn\u0027t held\\nwhile the -\u003ebind() callback is invoked. So we\u0027ll drop the mutex\\nbefore performing the unbind callback and reacquire it afterward.\\n\\nWe\u0027ll also add a couple of comments to usb_gadget_activate() and\\nusb_gadget_deactivate(). Because they run in process context they\\nmust not be called from a gadget driver\u0027s -\u003edisconnect() callback,\\nwhich (according to the kerneldoc for struct usb_gadget_driver in\\ninclude/linux/usb/gadget.h) may run in interrupt context. This may\\nhelp prevent similar bugs from arising in the future.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/usb/gadget/udc/core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"d8195536ce2624e2947d9f56b1a61e7a27874bd3\",\"lessThan\":\"bed19d95fcb9c98dfaa9585922b39a2dfba7898d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"286d9975a838d0a54da049765fa1d1fb96b89682\",\"lessThan\":\"8c1edc00db65f6d4408b3d1cd845e8da3b9e0ca4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"286d9975a838d0a54da049765fa1d1fb96b89682\",\"lessThan\":\"65dadb2beeb7360232b09ebc4585b54475dfee06\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"85102a45c7390caf124a3a5796574446f1e037b9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6.1.35\",\"lessThan\":\"6.1.46\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.3.9\",\"lessThan\":\"6.4\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/usb/gadget/udc/core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.4\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.4\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.46\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.4.11\",\"lessThanOrEqual\":\"6.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.5\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-667\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.1.35\",\"versionEndExcluding\":\"6.1.46\",\"matchCriteriaId\":\"A587EE0A-8AC0-46BA-99D5-CD931034FB9A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.3.9\",\"versionEndExcluding\":\"6.4\",\"matchCriteriaId\":\"0F0AC27C-C1AB-49CF-A549-0BF7D8370313\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.4.1\",\"versionEndExcluding\":\"6.4.11\",\"matchCriteriaId\":\"1C678B72-1C6D-44C9-82A5-F7A6B203FD9F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.4:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"DE0B0BF6-0EEF-4FAD-927D-7A0DD77BEE75\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.4:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"1D6CAA59-F0EF-4E0B-8C23-EC9535008572\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.5:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"0B3E6E4D-E24E-4630-B00C-8C9901C597B0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.5:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"E4A01A71-0F09-4DB2-A02F-7EFFBE27C98D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.5:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F5608371-157A-4318-8A2E-4104C3467EA1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.5:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"2226A776-DF8C-49E0-A030-0A7853BB018A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.5:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"6F15C659-DF06-455A-9765-0E6DE920F29A\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/65dadb2beeb7360232b09ebc4585b54475dfee06\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8c1edc00db65f6d4408b3d1cd845e8da3b9e0ca4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/bed19d95fcb9c98dfaa9585922b39a2dfba7898d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-08-04T19:16:50+00:00",
"cve": "CVE-2023-53580",
"id": "CVE-2023-53580",
"initial_release_date": "2023-01-01T00:00:00+00:00",
"product_status:fixed": "279",
"product_status:known_affected": "22",
"product_status:known_not_affected": "166",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: USB: Gadget: core: Help prevent panic during UVC unconfigure",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-53580.json",
"version": "3"
},
"suse_vex": {
"aggregate_severity": "moderate",
"current_release_date": "2026-09-11T02:20:13Z",
"cve": "CVE-2023-53580",
"id": "CVE-2023-53580",
"initial_release_date": "2025-10-05T02:56:00Z",
"product_status:known_affected": "435",
"product_status:known_not_affected": "265",
"product_status:recommended": "426",
"source": "SUSE CSAF VEX",
"status": "interim",
"title": "SUSE CVE CVE-2023-53580",
"url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-53580.json",
"version": "46"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…