LiveActive security incident?Get immediate response
CVE Record

CVE-2023-54159: usb: mtu3: fix kernel panic at qmu transfer done irq handler

In the Linux kernel, the following vulnerability has been resolved: usb: mtu3: fix kernel panic at qmu transfer done irq handler When handle qmu transfer irq, it will unlock @mtu->lock before give back request, if another thread handle disconnect event at the same time, and try to disable ep, it may lock @mtu->lock and free qmu ring, then qmu irq hanlder may get a NULL gpd, avoid the KE by checking gpd's value before handling it. e.g. qmu done irq on cpu0 thread running on cpu1 qmu_done_tx() handle gpd [0] mtu3_requ_complete() mtu3_gadget_ep_disable() unlock @mtu->lock give back request lock @mtu->lock mtu3_ep_disable() mtu3_gpd_ring_free() unlock @mtu->lock lock @mtu->lock get next gpd [1] [1]: goto [0] to handle next gpd, and next gpd may be NULL.

UnknownCVSS not scoredNot KEV-listedUpdated
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue can trigger a kernel panic during USB transfer completion handling. It appears tied to a race between interrupt handling and endpoint disconnect/disable cleanup. Business impact is likely availability, not data theft, but affected systems using this USB path could crash unexpectedly.

Executive priority

Treat as a targeted availability risk for Linux platforms using the affected USB driver. Patch through normal kernel maintenance unless the driver is present on business-critical or remotely managed devices, where downtime risk justifies faster action.

Technical view

The mtu3 USB driver releases mtu->lock while completing a request. A concurrent disconnect path can free the QMU ring before the IRQ handler advances to the next GPD, leaving a NULL GPD and causing a kernel exception. The fix checks the GPD before handling it.

Likely exposure

Exposure appears limited to Linux systems running affected kernel builds with the mtu3 USB driver path in use. The source bundle names Linux and version markers, but does not identify specific distributions, appliances, or hardware models.

Exploitation context

The bundle does not show CISA KEV listing or any cited evidence of active exploitation. Available evidence supports a crash/denial-of-service style failure from a timing race, not confirmed remote compromise.

Researcher notes

Evidence is limited to the CVE record and Linux stable commit references. No CVSS, CWE, exploitability detail, or distribution mapping is provided. Avoid broad exposure claims without confirming mtu3 driver presence and fixed commit inclusion.

Mitigation direction

  • Check Linux vendor advisories for CVE-2023-54159 applicability to deployed kernels.
  • Apply kernel updates that include the referenced stable mtu3 fix commits.
  • Prioritize systems using mtu3 USB controller or gadget functionality.
  • If updates are unavailable, ask the vendor for supported mitigations.

Validation and detection

  • Inventory kernel versions and confirm whether mtu3 driver support is present.
  • Compare deployed kernels against vendor-fixed releases or referenced stable commits.
  • Review crash logs for mtu3, QMU, GPD, or USB disconnect panic indicators.
  • Confirm updated kernels include the NULL GPD handling change.
Prepared
Confidence
medium
Sources
9

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-54159 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
8Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux48e0d3735aa557a8adaf94632ca3cf78798e8505, 48e0d3735aa557a8adaf94632ca3cf78798e8505, 48e0d3735aa557a8adaf94632ca3cf78798e8505, 48e0d3735aa557a8adaf94632ca3cf78798e8505, 48e0d3735aa557a8adaf94632ca3cf78798e8505, 48e0d3735aa557a8adaf94632ca3cf78798e8505, 48e0d3735aa557a8adaf94632ca3cf78798e8505unaffected
LinuxLinux5.2, 0, 5.4.243, 5.10.180, 5.15.111, 6.1.28, 6.2.15, 6.3.2, 6.4affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.