CVE-2023-53693
BaseFortify
Publication date: 2025-10-22
Last updated on: 2025-10-22
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a memory leak in the Linux kernel's USB raw_gadget driver. The issue occurs because the reference count (raw_dev->count) is increased before calling raw_queue_event(). If raw_queue_event() returns an error, the cleanup function raw_release() does not trigger dev_free(), causing allocated memory not to be freed properly. The fix involves only increasing the reference count if raw_queue_event() succeeds, preventing the memory leak.
How can this vulnerability impact me? :
The memory leak in the USB raw_gadget driver can lead to increased memory usage over time, potentially causing system instability or crashes if the leaked memory accumulates. This can degrade system performance or cause denial of service conditions on affected Linux systems using this driver.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking system logs for specific error messages related to the raw_gadget USB driver. Look for messages such as 'failed to queue event', 'failed to start USB Raw Gadget: -12', 'probe of gadget.0 failed with error -12', or 'USB Raw Gadget: couldn't find an available UDC or it's busy'. You can use the command 'dmesg | grep raw-gadget' or 'journalctl -k | grep raw-gadget' to find these logs. Additionally, monitoring for memory leaks related to the raw_gadget driver in kernel logs may help detect the issue.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update the Linux kernel to a version where the raw_gadget driver memory leak has been fixed. The fix involves ensuring that kref_get() is only called when raw_queue_event() returns success, preventing the memory leak. Until an update is applied, avoid using the raw_gadget USB driver or disable it if possible to prevent triggering the memory leak.