CVE-2023-52898

What it actually does

Race condition between xhci_free_dev() freeing xhci->devs[slot_id] and xhci_kill_endpoint_urbs() iterating endpoints without the xhci spinlock held, allowing null pointer dereference on sudden host death.

Why it matters to the business

Unexpected system crashes or instability on Linux-based devices and Android systems handling USB, increasing downtime and support costs; high downstream kernel prevalence amplifies exposure across servers, desktops, and embedded platforms.

How an attack unfolds

An attacker with local access or ability to trigger USB host controller failure (via hardware manipulation, driver faults, or crafted device events) can force concurrent calls to free and kill functions, dereferencing a freed virt device pointer and causing kernel panic before the spinlock protects the operation.

How to fix it

Update to a kernel containing commit 6fac4b5cecb3928a0a81069aaa815a2edc8dd5a1 or later; apply the corresponding Android platform/system/bt fixes dated 2021-06-01; rebuild and reboot into the patched kernel image.

How to confirm the fix worked

Verify the running kernel includes commit 6fac4b5cecb3928a0a81069aaa815a2edc8dd5a1 via git log or uname output against the fixed tag; test USB hotplug and host reset scenarios for absence of null dereference panics.

Typical attack path

1. Gain local execution or USB device interaction capability
2. Trigger sudden xHCI host death condition while a device slot is active
3. Induce timing where xhci_free_dev() and xhci_kill_endpoint_urbs() race
4. Dereference null pointer in endpoint URB handling leading to crash

How to detect it

Review kernel logs for null pointer dereference traces involving xhci_free_dev or xhci_kill_endpoint_urbs during USB host reset events; correlate with dmesg entries showing xHCI host death.

What your security team should do

• Prioritize patching production kernels within standard change windows given the 785-day disclosure window
• Monitor vendor advisories for backported fixes in distribution kernels
• Harden USB access controls for untrusted devices until patches are deployed