CVE-2023-53454

What it actually does

Use-after-free in HID multitouch driver caused by devm allocation of input_dev name referencing the input device instead of the HID device, leading to freed memory access during uevent firing after input_dev unregistration.

Why it matters to the business

Kernel instability or crashes on systems with multitouch HID devices; low exploitation likelihood reduces immediate risk but still requires prompt patching on Linux environments to avoid potential local impact.

How an attack unfolds

An attacker with access to trigger HID device attach/detach sequences causes the input_dev name to be freed prematurely; subsequent uevent processing then dereferences the dangling pointer, potentially enabling memory corruption or escalation in affected kernels.

How to fix it

Update Linux kernel to commit ac0d389402a6ff9ad92cea02c2d8c711483b91ab or later; for listed Debian roundcube packages apply 1.4.5+dfsg.1-1 or newer where applicable.

How to confirm the fix worked

Verify kernel source contains the corrected devm_kasprintf call referencing the HID device; confirm input_dev name allocation no longer uses input device lifetime; test HID attach/detach cycles without uevent crashes.

Typical attack path

1. Attach or manipulate multitouch HID input device to trigger input_dev registration
2. Cause input_dev unregistration while uevent is pending
3. Trigger uevent that accesses the now-freed name string allocated via incorrect devm reference
4. Exploit resulting use-after-free for memory corruption or privilege escalation

How to detect it

Review kernel logs for use-after-free warnings or panics during HID uevent processing; inspect dmesg and audit logs around device attach/detach events for signs of input_dev name corruption.

What your security team should do

• Apply kernel update containing ac0d389402a6ff9ad92cea02c2d8c711483b91ab immediately on affected systems
• Prioritize patching production Linux hosts with HID multitouch hardware
• Monitor for new EPSS increases or KEV inclusion given 394 days since publication