CVE-2023-54256
Unknown Unknown - Not Provided
Device Reset Logic Flaw in Linux dwc3 USB Causes Kernel Panic

Publication date: 2025-12-30

Last updated on: 2025-12-30

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: don't reset device side if dwc3 was configured as host-only Commit c4a5153e87fd ("usb: dwc3: core: Power-off core/PHYs on system_suspend in host mode") replaces check for HOST only dr_mode with current_dr_role. But during booting, the current_dr_role isn't initialized, thus the device side reset is always issued even if dwc3 was configured as host-only. What's more, on some platforms with host only dwc3, aways issuing device side reset by accessing device register block can cause kernel panic.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-12-30
Last Modified
2025-12-30
Generated
2026-06-16
AI Q&A
2025-12-30
EPSS Evaluated
N/A
NVD
CVE-2023-54256
EUVD
EUVD-2023-60385
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability occurs in the Linux kernel's USB driver for the dwc3 controller. During system boot, the current device role (host or device) isn't properly initialized, causing the system to always perform a device-side reset even when the dwc3 controller is configured as host-only. This improper reset can lead to issues on some platforms, including kernel panic, because the device register block is accessed incorrectly.

Impact Analysis

If your system uses the dwc3 USB controller configured as host-only, this vulnerability can cause the kernel to panic during boot due to improper device-side resets. This can lead to system instability or crashes, potentially affecting availability and reliability.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2023-54256. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart