BaseFortify

Publication date: 2025-12-24

Last updated on: 2025-12-29

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: phy: tegra: xusb: Clear the driver reference in usb-phy dev For the dual-role port, it will assign the phy dev to usb-phy dev and use the port dev driver as the dev driver of usb-phy. When we try to destroy the port dev, it will destroy its dev driver as well. But we did not remove the reference from usb-phy dev. This might cause the use-after-free issue in KASAN.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-24

Last Modified

2025-12-29

Generated

2026-07-06

AI Q&A

2025-12-24

EPSS Evaluated

2026-07-05

NVD

CVE-2023-54083

EUVD

EUVD-2023-60362

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability occurs in the Linux kernel's tegra xusb driver where the driver reference in the usb-phy device is not cleared when the port device is destroyed. Specifically, for a dual-role port, the phy device is assigned to the usb-phy device and uses the port device driver as the usb-phy device driver. When the port device is destroyed, its driver is also destroyed, but the reference in the usb-phy device remains. This can lead to a use-after-free issue detected by KASAN (Kernel Address Sanitizer).

Impact Analysis

This vulnerability can cause a use-after-free condition in the kernel, which may lead to system instability, crashes, or potential security risks such as privilege escalation or arbitrary code execution if exploited. It affects the reliability and security of systems using the affected Linux kernel component.

Hi! I’m here to help you understand CVE-2023-54083. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70