LiveActive security incident?Get immediate response
CVE Record

CVE-2023-52886: USB: core: Fix race by not overwriting udev->descriptor in hub_port_init()

In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix race by not overwriting udev->descriptor in hub_port_init() Syzbot reported an out-of-bounds read in sysfs.c:read_descriptors(): BUG: KASAN: slab-out-of-bounds in read_descriptors+0x263/0x280 drivers/usb/core/sysfs.c:883 Read of size 8 at addr ffff88801e78b8c8 by task udevd/5011 CPU: 0 PID: 5011 Comm: udevd Not tainted 6.4.0-rc6-syzkaller-00195-g40f71e7cd3c6 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd9/0x150 lib/dump_stack.c:106 print_address_description.constprop.0+0x2c/0x3c0 mm/kasan/report.c:351 print_report mm/kasan/report.c:462 [inline] kasan_report+0x11c/0x130 mm/kasan/report.c:572 read_descriptors+0x263/0x280 drivers/usb/core/sysfs.c:883 ... Allocated by task 758: ... __do_kmalloc_node mm/slab_common.c:966 [inline] __kmalloc+0x5e/0x190 mm/slab_common.c:979 kmalloc include/linux/slab.h:563 [inline] kzalloc include/linux/slab.h:680 [inline] usb_get_configuration+0x1f7/0x5170 drivers/usb/core/config.c:887 usb_enumerate_device drivers/usb/core/hub.c:2407 [inline] usb_new_device+0x12b0/0x19d0 drivers/usb/core/hub.c:2545 As analyzed by Khazhy Kumykov, the cause of this bug is a race between read_descriptors() and hub_port_init(): The first routine uses a field in udev->descriptor, not expecting it to change, while the second overwrites it. Prior to commit 45bf39f8df7f ("USB: core: Don't hold device lock while reading the "descriptors" sysfs file") this race couldn't occur, because the routines were mutually exclusive thanks to the device locking. Removing that locking from read_descriptors() exposed it to the race. The best way to fix the bug is to keep hub_port_init() from changing udev->descriptor once udev has been initialized and registered. Drivers expect the descriptors stored in the kernel to be immutable; we should not undermine this expectation. In fact, this change should have been made long ago. So now hub_port_init() will take an additional argument, specifying a buffer in which to store the device descriptor it reads. (If udev has not yet been initialized, the buffer pointer will be NULL and then hub_port_init() will store the device descriptor in udev as before.) This eliminates the data race responsible for the out-of-bounds read. The changes to hub_port_init() appear more extensive than they really are, because of indentation changes resulting from an attempt to avoid writing to other parts of the usb_device structure after it has been initialized. Similar changes should be made to the code that reads the BOS descriptor, but that can be handled in a separate patch later on. This patch is sufficient to fix the bug found by syzbot.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2023-52886 is a Linux kernel USB core race condition. During USB device handling, one kernel path could change descriptor data while another read it, causing an out-of-bounds read. The public record does not provide CVSS scoring, active exploitation evidence, or confirmed business impact beyond kernel memory-safety risk.

Executive priority

Treat this as a kernel maintenance item with uncertain severity. Patch through normal Linux update channels, prioritizing systems with physical or virtual USB exposure. There is no source-backed evidence here of active exploitation or internet-scale urgency.

Technical view

The flaw is in hub_port_init() and read_descriptors(). After earlier locking was removed from read_descriptors(), hub_port_init() could overwrite udev->descriptor after device initialization, violating descriptor immutability assumptions and triggering a KASAN slab out-of-bounds read in USB sysfs descriptor reads.

Likely exposure

Exposure is limited to Linux systems running affected kernel versions or downstream builds containing the vulnerable USB core code. The source references Linux kernel records and stable fixes only; it does not identify specific distributions, appliances, cloud images, or remote exposure paths.

Exploitation context

The issue was reported by syzbot and analyzed as a race condition. The bundle marks KEV as false and provides no cited evidence of active exploitation, public exploit use, privilege requirements, or remote attackability.

Researcher notes

The fix changes hub_port_init() to use a separate buffer for descriptor reads after initialization, preserving udev->descriptor immutability. The record notes similar BOS descriptor handling could need later work, but says this patch fixes the syzbot-found bug.

Mitigation direction

  • Apply a vendor kernel update containing the referenced stable USB core fix.
  • Prioritize systems that accept untrusted or frequently changing USB devices.
  • Check Linux distribution advisories for exact fixed package versions.
  • Avoid direct wrangler-style assumptions; follow vendor kernel maintenance guidance.

Validation and detection

  • Inventory running Linux kernel versions across servers, workstations, and appliances.
  • Compare kernels against distribution advisories and the referenced stable commits.
  • Confirm patched systems include the hub_port_init() descriptor handling change.
  • Review USB-heavy or physically exposed systems for higher operational priority.
Prepared
Confidence
medium
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-52886 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
7Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux218925bfd5d1436e337c4f961e9c149fbe32de6d, 77358093331e9769855140bf94a3f00ecdcf4bb1, c87fb861ec185fdc578b4fdc6a05920b6a843840, 45bf39f8df7f05efb83b302c65ae3b9bc92b7065, 45bf39f8df7f05efb83b302c65ae3b9bc92b7065, 45bf39f8df7f05efb83b302c65ae3b9bc92b7065, 6badaf880edf51a2da7a439699676394dfdef3e5, 5f35b5d3bd6914c68f743741443dfd3a64b0e455, a1e89c8b29d003a20ed2dae6bdae1598d1f23e42, 1bcb238c54a9c6dc4bded06b06ba7458a5eefa87unaffected
LinuxLinux6.3, 0, 5.10.195, 5.15.132, 6.1.53, 6.4.16, 6.5.3, 6.6affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.