CVE-2023-53548
BaseFortify
Publication date: 2025-10-04
Last updated on: 2026-03-21
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.5 |
| linux | linux_kernel | 6.5 |
| linux | linux_kernel | From 4.15 (inc) to 4.19.291 (exc) |
| linux | linux_kernel | From 6.2 (inc) to 6.4.10 (exc) |
| linux | linux_kernel | From 5.16 (inc) to 6.1.45 (exc) |
| linux | linux_kernel | From 5.11 (inc) to 5.15.126 (exc) |
| linux | linux_kernel | From 5.5 (inc) to 5.10.190 (exc) |
| linux | linux_kernel | From 4.20 (inc) to 5.4.253 (exc) |
| linux | linux_kernel | From 2.6.14 (inc) to 4.14.322 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in the Linux kernel's usbnet driver occurs because the driver trusts the bulk endpoint addresses it receives without verifying that these endpoints actually exist and have the expected type and direction. This can lead to a WARNING and potential malfunction when the driver attempts to submit USB requests (URBs) to invalid or incorrect endpoints. The issue was identified by the syzbot fuzzer and fixed by adding proper checks to validate the endpoints.
How can this vulnerability impact me? :
The vulnerability can cause warnings and errors in the kernel when the usbnet driver tries to submit USB requests to invalid endpoints. This may lead to instability or malfunction of USB network devices using the usbnet driver, potentially affecting network connectivity or system reliability.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring the system logs for warnings related to usbnet and usb_submit_urb, specifically messages like 'BOGUS urb xfer, pipe 3 != type 1' or warnings in usbnet_start_xmit/usb_submit_urb. You can use commands such as 'dmesg | grep usbnet' or 'journalctl -k | grep usbnet' to check for these warnings in the kernel logs.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves updating the Linux kernel to a version where this vulnerability is fixed, as the issue is resolved by adding checks to verify endpoint existence and types in the usbnet driver. Until an update is applied, avoid using untrusted USB network devices to reduce exposure.