CVE-2023-54159: usb: mtu3: fix kernel panic at qmu transfer done irq handler
In the Linux kernel, the following vulnerability has been resolved:
usb: mtu3: fix kernel panic at qmu transfer done irq handler
When handle qmu transfer irq, it will unlock @mtu->lock before give back
request, if another thread handle disconnect event at the same time, and
try to disable ep, it may lock @mtu->lock and free qmu ring, then qmu
irq hanlder may get a NULL gpd, avoid the KE by checking gpd's value before
handling it.
e.g.
qmu done irq on cpu0 thread running on cpu1
qmu_done_tx()
handle gpd [0]
mtu3_requ_complete() mtu3_gadget_ep_disable()
unlock @mtu->lock
give back request lock @mtu->lock
mtu3_ep_disable()
mtu3_gpd_ring_free()
unlock @mtu->lock
lock @mtu->lock
get next gpd [1]
[1]: goto [0] to handle next gpd, and next gpd may be NULL.
Security readout for executives and security teams
Plain-English summary
This Linux kernel issue can trigger a kernel panic during USB transfer completion handling. It appears tied to a race between interrupt handling and endpoint disconnect/disable cleanup. Business impact is likely availability, not data theft, but affected systems using this USB path could crash unexpectedly.
Executive priority
Treat as a targeted availability risk for Linux platforms using the affected USB driver. Patch through normal kernel maintenance unless the driver is present on business-critical or remotely managed devices, where downtime risk justifies faster action.
Technical view
The mtu3 USB driver releases mtu->lock while completing a request. A concurrent disconnect path can free the QMU ring before the IRQ handler advances to the next GPD, leaving a NULL GPD and causing a kernel exception. The fix checks the GPD before handling it.
Likely exposure
Exposure appears limited to Linux systems running affected kernel builds with the mtu3 USB driver path in use. The source bundle names Linux and version markers, but does not identify specific distributions, appliances, or hardware models.
Exploitation context
The bundle does not show CISA KEV listing or any cited evidence of active exploitation. Available evidence supports a crash/denial-of-service style failure from a timing race, not confirmed remote compromise.
Researcher notes
Evidence is limited to the CVE record and Linux stable commit references. No CVSS, CWE, exploitability detail, or distribution mapping is provided. Avoid broad exposure claims without confirming mtu3 driver presence and fixed commit inclusion.
Mitigation direction
Check Linux vendor advisories for CVE-2023-54159 applicability to deployed kernels.
Apply kernel updates that include the referenced stable mtu3 fix commits.
Prioritize systems using mtu3 USB controller or gadget functionality.
If updates are unavailable, ask the vendor for supported mitigations.
Validation and detection
Inventory kernel versions and confirm whether mtu3 driver support is present.
Compare deployed kernels against vendor-fixed releases or referenced stable commits.
Review crash logs for mtu3, QMU, GPD, or USB disconnect panic indicators.
Confirm updated kernels include the NULL GPD handling change.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2023-54159 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
0CVSS vectors
3Timeline events
0ADP providers
8Source links
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
CVE publishedCVE Program
The CVE record was published.
Dec 24, 2025, 13:07 UTC (UTC+00:00)
CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.