LiveActive security incident?Get immediate response
CVE Record

CVE-2023-54207: HID: uclogic: Correct devm device reference for hidinput input_dev name

In the Linux kernel, the following vulnerability has been resolved: HID: uclogic: Correct devm device reference for hidinput input_dev name Reference the HID device rather than the input device for the devm allocation of the input_dev name. Referencing the input_dev would lead to a use-after-free when the input_dev was unregistered and subsequently fires a uevent that depends on the name. At the point of firing the uevent, the name would be freed by devres management. Use devm_kasprintf to simplify the logic for allocating memory and formatting the input_dev name string.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2023-54207 is a Linux kernel memory lifetime bug in the HID UC-Logic driver. A device name could be freed before a later device event used it, creating a use-after-free condition. The provided sources do not include CVSS, proven impact, or active exploitation evidence.

Executive priority

Treat this as a kernel maintenance issue with uncertain severity. Prioritize normal kernel update cycles, escalating for fleets that use UC-Logic HID hardware, embedded Linux, or custom kernels where fixes may not arrive automatically.

Technical view

The flaw is in the Linux HID uclogic path for hidinput input_dev naming. The fix changes devm allocation to reference the HID device rather than the input device, preventing devres from freeing the name before unregister-related uevents access it.

Likely exposure

Likely exposure is limited to Linux systems running affected kernel versions with the HID UC-Logic driver path present, especially desktops, tablets, embedded devices, or workstations using compatible HID input hardware. Generic servers without this driver or hardware are less likely exposed, but kernel configuration must be verified.

Exploitation context

The bundle states no KEV listing and provides no cited evidence of active exploitation. It describes a kernel use-after-free triggered during input device unregister and uevent handling. Practical exploitability, required local access, and security impact are not established in the supplied sources.

Researcher notes

The key condition is devres ownership of input_dev name memory. The source explains that referencing input_dev allows name memory to be freed before a later unregister uevent uses it. No CVSS, CWE, exploit vector, or confirmed impact is provided.

Mitigation direction

  • Update to a vendor kernel containing the referenced stable fix commit for your branch.
  • Check Linux distribution advisories for exact fixed package versions.
  • Prioritize systems using UC-Logic HID tablets or related input hardware.
  • For embedded Linux, request a fixed kernel from the device vendor.
  • If patching is delayed, follow vendor guidance for reducing affected HID exposure.

Validation and detection

  • Inventory running kernel versions and compare them with vendor fixed-package advisories.
  • Check whether the HID UC-Logic driver is built, loaded, or available on target systems.
  • Verify the applicable stable commit is present in custom kernel trees.
  • Regression-test input devices after updating the kernel.
  • Track CVE record updates because severity and exploitability details are incomplete.
Prepared
Confidence
medium
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-54207 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
7Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxcce2dbdf258e6b27b2b100f511531edabb77f427, cce2dbdf258e6b27b2b100f511531edabb77f427, cce2dbdf258e6b27b2b100f511531edabb77f427, cce2dbdf258e6b27b2b100f511531edabb77f427, cce2dbdf258e6b27b2b100f511531edabb77f427, cce2dbdf258e6b27b2b100f511531edabb77f427unaffected
LinuxLinux4.1, 0, 5.10.249, 5.15.199, 6.1.53, 6.4.16, 6.5.3, 6.6affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.