CVE-2023-54159
published 2025-12-24CVE-2023-54159: In the Linux kernel, the following vulnerability has been resolved: usb: mtu3: fix kernel panic at qmu transfer done irq handler When handle qmu transfer irq…
PriorityP420
EPSS
0.18%
7.7th percentile
In the Linux kernel, the following vulnerability has been resolved:
usb: mtu3: fix kernel panic at qmu transfer done irq handler
When handle qmu transfer irq, it will unlock @mtu->lock before give back
request, if another thread handle disconnect event at the same time, and
try to disable ep, it may lock @mtu->lock and free qmu ring, then qmu
irq hanlder may get a NULL gpd, avoid the KE by checking gpd's value before
handling it.
e.g.
qmu done irq on cpu0 thread running on cpu1
qmu_done_tx()
handle gpd [0]
mtu3_requ_complete() mtu3_gadget_ep_disable()
unlock @mtu->lock
give back request lock @mtu->lock
mtu3_ep_disable()
mtu3_gpd_ring_free()
unlock @mtu->lock
lock @mtu->lock
get next gpd [1]
[1]: goto [0] to handle next gpd, and next gpd may be NULL.
Affected
19 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.37-1 (bookworm) | linux 6.1.37-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 48e0d3735aa557a8adaf94632ca3cf78798e8505 < 26ca30516b2c49dd04c134cbdf122311c538df98 | 26ca30516b2c49dd04c134cbdf122311c538df98 |
| linux | linux | >= 48e0d3735aa557a8adaf94632ca3cf78798e8505 < 012936502a9cb7b0604e85bb961eb15e2bb40dd9 | 012936502a9cb7b0604e85bb961eb15e2bb40dd9 |
| linux | linux | >= 48e0d3735aa557a8adaf94632ca3cf78798e8505 < ee53a7a88027cea765c68f3b00a50b8f58d6f786 | ee53a7a88027cea765c68f3b00a50b8f58d6f786 |
| linux | linux | >= 48e0d3735aa557a8adaf94632ca3cf78798e8505 < f26273428657ef4ca74740e578ae45a3be492f6f | f26273428657ef4ca74740e578ae45a3be492f6f |
| linux | linux | >= 48e0d3735aa557a8adaf94632ca3cf78798e8505 < b636aff94a67be46582d4321d11743f1a10cc2c1 | b636aff94a67be46582d4321d11743f1a10cc2c1 |
| linux | linux | >= 48e0d3735aa557a8adaf94632ca3cf78798e8505 < 3a7d4959560a2ee493ef222e3b63d359365f41ec | 3a7d4959560a2ee493ef222e3b63d359365f41ec |
| linux | linux | >= 48e0d3735aa557a8adaf94632ca3cf78798e8505 < d28f4091ea7ec3510fd6a3c6d433234e7a2bef14 | d28f4091ea7ec3510fd6a3c6d433234e7a2bef14 |
| linux | linux_kernel | >= 0 < 5.10.191-1 | 5.10.191-1 |
| linux | linux_kernel | >= 0 < 6.1.37-1 | 6.1.37-1 |
| linux | linux_kernel | >= 0 < 6.3.7-1 | 6.3.7-1 |
| linux | linux_kernel | >= 0 < 6.3.7-1 | 6.3.7-1 |
| linux | linux_kernel | >= 5.11.0 < 5.15.111 | 5.15.111 |
| linux | linux_kernel | >= 5.16.0 < 6.1.28 | 6.1.28 |
| linux | linux_kernel | >= 5.2.0 < 5.4.243 | 5.4.243 |
| linux | linux_kernel | >= 5.5.0 < 5.10.180 | 5.10.180 |
| linux | linux_kernel | >= 6.2.0 < 6.2.15 | 6.2.15 |
| linux | linux_kernel | >= 6.3.0 < 6.3.2 | 6.3.2 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
usb: mtu3: fix kernel panic at qmu transfer done irq handler
osv·2025-12-24
CVE-2023-54159 usb: mtu3: fix kernel panic at qmu transfer done irq handler
usb: mtu3: fix kernel panic at qmu transfer done irq handler
In the Linux kernel, the following vulnerability has been resolved:
usb: mtu3: fix kernel panic at qmu transfer done irq handler
When handle qmu transfer irq, it will unlock @mtu->lock before give back
request, if another thread handle disconnect event at the same time, and
try to disable ep, it may lock @mtu->lock and free qmu ring, then qmu
irq hanlder may get a NULL gpd, avoid the KE by checking gpd's value before
handling it.
e.g.
qmu done irq on cpu0 thread running on cpu1
qmu_done_tx()
handle gpd [0]
mtu3_requ_complete() mtu3_gadget_ep_disable()
unlock @mtu->lock
give back request lock @mtu->lock
mtu3_ep_disable()
mtu3_gpd_ring_free()
unlock @mtu->lock
lock @mtu->lock
get next gpd [1]
[1]: goto [0] to handle next gpd,
GHSA
GHSA-mgqh-xx5m-2h5f: In the Linux kernel, the following vulnerability has been resolved:
usb: mtu3: fix kernel panic at qmu transfer done irq handler
When handle qmu tra
ghsa_unreviewed·2025-12-24
CVE-2023-54159 GHSA-mgqh-xx5m-2h5f: In the Linux kernel, the following vulnerability has been resolved:
usb: mtu3: fix kernel panic at qmu transfer done irq handler
When handle qmu tra
In the Linux kernel, the following vulnerability has been resolved:
usb: mtu3: fix kernel panic at qmu transfer done irq handler
When handle qmu transfer irq, it will unlock @mtu->lock before give back
request, if another thread handle disconnect event at the same time, and
try to disable ep, it may lock @mtu->lock and free qmu ring, then qmu
irq hanlder may get a NULL gpd, avoid the KE by checking gpd's value before
handling it.
e.g.
qmu done irq on cpu0 thread running on cpu1
qmu_done_tx()
handle gpd [0]
mtu3_requ_complete() mtu3_gadget_ep_disable()
unlock @mtu->lock
give back request lock @mtu->lock
mtu3_ep_disable()
mtu3_gpd_ring_free()
unlock @mtu->lock
lock @mtu->lock
get next gpd [1]
[1]: goto [0] to handle next gpd, and next gpd may be NULL.
OSV
CVE-2023-54159: In the Linux kernel, the following vulnerability has been resolved: usb: mtu3: fix kernel panic at qmu transfer done irq handler When handle qmu trans
osv·2025-12-24
CVE-2023-54159 CVE-2023-54159: In the Linux kernel, the following vulnerability has been resolved: usb: mtu3: fix kernel panic at qmu transfer done irq handler When handle qmu trans
In the Linux kernel, the following vulnerability has been resolved: usb: mtu3: fix kernel panic at qmu transfer done irq handler When handle qmu transfer irq, it will unlock @mtu->lock before give back request, if another thread handle disconnect event at the same time, and try to disable ep, it may lock @mtu->lock and free qmu ring, then qmu irq hanlder may get a NULL gpd, avoid the KE by checking gpd's value before handling it. e.g. qmu done irq on cpu0 thread running on cpu1 qmu_done_tx() handle gpd [0] mtu3_requ_complete() mtu3_gadget_ep_disable() unlock @mtu->lock give back request lock @mtu->lock mtu3_ep_disable() mtu3_gpd_ring_free() unlock @mtu->lock lock @mtu->lock get next gpd [1] [1]: goto [0] to handle next gpd, and next gpd may be NULL.
Red Hat
kernel: usb: mtu3: fix kernel panic at qmu transfer done irq handler
vendor_redhat·2025-12-24
CVE-2023-54159 kernel: usb: mtu3: fix kernel panic at qmu transfer done irq handler
kernel: usb: mtu3: fix kernel panic at qmu transfer done irq handler
In the Linux kernel, the following vulnerability has been resolved:
usb: mtu3: fix kernel panic at qmu transfer done irq handler
When handle qmu transfer irq, it will unlock @mtu->lock before give back
request, if another thread handle disconnect event at the same time, and
try to disable ep, it may lock @mtu->lock and free qmu ring, then qmu
irq hanlder may get a NULL gpd, avoid the KE by checking gpd's value before
handling it.
e.g.
qmu done irq on cpu0 thread running on cpu1
qmu_done_tx()
handle gpd [0]
mtu3_requ_complete() mtu3_gadget_ep_disable()
unlock @mtu->lock
give back request lock @mtu->lock
mtu3_ep_disable()
mtu3_gpd_ring_free()
unlock @mtu->lock
lock @mtu->lock
get next gpd [1]
[1]: goto [0] to handle next g
Debian
CVE-2023-54159: linux - In the Linux kernel, the following vulnerability has been resolved: usb: mtu3: ...
vendor_debian·2023
CVE-2023-54159 CVE-2023-54159: linux - In the Linux kernel, the following vulnerability has been resolved: usb: mtu3: ...
In the Linux kernel, the following vulnerability has been resolved: usb: mtu3: fix kernel panic at qmu transfer done irq handler When handle qmu transfer irq, it will unlock @mtu->lock before give back request, if another thread handle disconnect event at the same time, and try to disable ep, it may lock @mtu->lock and free qmu ring, then qmu irq hanlder may get a NULL gpd, avoid the KE by checking gpd's value before handling it. e.g. qmu done irq on cpu0 thread running on cpu1 qmu_done_tx() handle gpd [0] mtu3_requ_complete() mtu3_gadget_ep_disable() unlock @mtu->lock give back request lock @mtu->lock mtu3_ep_disable() mtu3_gpd_ring_free() unlock @mtu->lock lock @mtu->lock get next gpd [1] [1]: goto [0] to handle next gpd, and next gpd may be NULL.
Scope: local
bookworm: resolved (fixed i
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2023-54159 kernel: usb: mtu3: fix kernel panic at qmu transfer done irq handler
bugzilla·2025-12-24
CVE-2023-54159 CVE-2023-54159 kernel: usb: mtu3: fix kernel panic at qmu transfer done irq handler
CVE-2023-54159 kernel: usb: mtu3: fix kernel panic at qmu transfer done irq handler
In the Linux kernel, the following vulnerability has been resolved:
usb: mtu3: fix kernel panic at qmu transfer done irq handler
When handle qmu transfer irq, it will unlock @mtu->lock before give back
request, if another thread handle disconnect event at the same time, and
try to disable ep, it may lock @mtu->lock and free qmu ring, then qmu
irq hanlder may get a NULL gpd, avoid the KE by checking gpd's value before
handling it.
e.g.
qmu done irq on cpu0 thread running on cpu1
qmu_done_tx()
handle gpd [0]
mtu3_requ_complete() mtu3_gadget_ep_disable()
unlock @mtu->lock
give back request lock @mtu->lock
mtu3_ep_disable()
mtu3_gpd_ring_free()
unlock @mtu->lock
lock @mtu->lock
get next gpd [1]
[1]: goto
Wiz
CVE-2023-54159 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz
CVE-2023-54159 CVE-2023-54159 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2023-54159 :
Linux Kernel vulnerability analysis and mitigation
In the Linux kernel, the following vulnerability has been resolved:
usb: mtu3: fix kernel panic at qmu transfer done irq handler
When handle qmu transfer irq, it will unlock @mtu->lock before give back
request, if another thread handle disconnect event at the same time, and
try to disable ep, it may lock @mtu->lock and free qmu ring, then qmu
irq hanlder may get a NULL gpd, avoid the KE by checking gpd's value before
handling it.
e.g.
qmu done irq on cpu0 thread running on cpu1
qmu_done_tx()
handle gpd [0]
mtu3_requ_complete() mtu3_gadget_ep_disable()
unlock @mtu->lock
give back request lock @mtu->lock
mtu3_ep_disable()
mtu3_gpd_ring_free()
unlock @mtu->lock
lock @mtu->lock
get next gpd 1
Source : NVD
Published
https://git.kernel.org/stable/c/012936502a9cb7b0604e85bb961eb15e2bb40dd9https://git.kernel.org/stable/c/26ca30516b2c49dd04c134cbdf122311c538df98https://git.kernel.org/stable/c/3a7d4959560a2ee493ef222e3b63d359365f41echttps://git.kernel.org/stable/c/b636aff94a67be46582d4321d11743f1a10cc2c1https://git.kernel.org/stable/c/d28f4091ea7ec3510fd6a3c6d433234e7a2bef14https://git.kernel.org/stable/c/ee53a7a88027cea765c68f3b00a50b8f58d6f786https://git.kernel.org/stable/c/f26273428657ef4ca74740e578ae45a3be492f6f
2025-12-24
Published