CVE-2023-54159

Vulnerability

CVE-2023-54159 is a race condition in the Linux kernel's MediaTek USB3 (mtu3) gadget driver that can cause a kernel panic (NULL pointer dereference) during QMU (Queue Manager Unit) transfer completion handling. The root cause is a missing NULL check on the GPD (General Purpose Descriptor) pointer after the driver releases the @mtu->lock spinlock to give back a USB request. If a concurrent thread disables the endpoint and frees the GPD ring while the lock is released, the IRQ handler may dereference a NULL or freed GPD on the next iteration [1][2].

Exploitation

Exploitation

Exploitation requires a local attacker with the ability to trigger both a USB gadget disconnect (or endpoint disable) and a simultaneous QMU transfer completion interrupt. The race window is narrow but deterministic: the IRQ handler on one CPU releases the lock, allowing a second CPU to disable the endpoint and free the ring, after which the handler re-acquires the lock and attempts to process the next GPD [0] again [1][3]. No special privileges beyond access to the USB gadget subsystem are needed.

Impact

A successful exploit results in a kernel NULL pointer dereference, leading to a system crash (denial of service). In some configurations, an attacker might leverage the use-after-free to achieve arbitrary code execution, though the primary impact is a local denial-of-service condition [1][4]."] [4].

Mitigation

The fix, merged into the Linux kernel stable branches, adds a NULL check on the GPD pointer before processing it in the QMU done handler [1][2][3][4]. Users should update to a kernel containing the commit f26273428657 or any of the backported versions. No workaround is available; the vulnerability is patched in all maintained stable kernels.