VYPR
← All advisories
High severity7.8NVD Advisory· Published Oct 1, 2025· Updated Jun 17, 2026

CVE-2023-53459

CVE-2023-53459

Description

In the Linux kernel, the following vulnerability has been resolved:

HID: mcp-2221: prevent UAF in delayed work

If the device is plugged/unplugged without giving time for mcp_init_work() to complete, we might kick in the devm free code path and thus have unavailable struct mcp_2221 while in delayed work.

Canceling the delayed_work item is enough to solve the issue, because cancel_delayed_work_sync will prevent the work item to requeue itself.

Affected products

4
  • Linux/Kernel3 versions
    cpe:2.3:o:linux:linux_kernel:6.2:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:o:linux:linux_kernel:6.2:*:*:*:*:*:*:*
    • (no CPE)
    • (no CPE)range: 6.2
  • osv-coords
    pkg:linux/kernel
    Range: >= 6.2.0, < 6.2.1

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.