CVE-2023-52901

What it actually does

NULL pointer dereference in xhci_hc_died when an xHCI host controller stops responding, triggered during URB cleanup on invalid endpoints.

Why it matters to the business

Unexpected system crashes on Linux-based devices with USB hardware faults or controller failures, leading to downtime and potential data loss in affected environments.

How an attack unfolds

An attacker or environmental condition causes the xHCI host controller to become unresponsive; queued URBs are then killed, dereferencing an invalid endpoint and triggering a kernel panic.

How to fix it

Update the Linux kernel to a version containing commit 375be2dd61a072f7b1cac9b17eea59e07b58db3a or apply the equivalent Android security patches released for versions 9/10/11 on 2021-12-01.

How to confirm the fix worked

Verify kernel source contains the xhci_get_virt_ep() check before dereference in xhci_hc_died; confirm no NULL dereference occurs on simulated host controller death.

Typical attack path

1. Trigger xHCI host controller failure or simulate non-responsive state
2. Ensure URBs are queued to endpoints
3. Invoke endpoint cleanup path in xhci_hc_died
4. Dereference invalid endpoint causing NULL pointer access

How to detect it

Review kernel logs for xhci-hcd host controller not responding messages followed by NULL pointer dereference in xhci_hc_died or xhci_stop_endpoint_command_watchdog; correlate with timer softirq and cpuidle stack traces.

What your security team should do

• Apply the referenced kernel commit or Android patch immediately on all affected systems
• Monitor for xHCI controller failure events in system logs
• Prioritize patching devices with high USB usage or known controller instability