CVE-2023-54079

What it actually does

Race condition in bq27xxx_battery_teardown() and remove() where poll_interval can be modified concurrently via sysfs after list removal but before delayed_work cancellation, and removal via sysfs unexpectedly alters poll_interval.

Why it matters to the business

Kernel instability or crashes on Linux systems using bq27xxx battery monitoring during driver unbind or parameter writes, affecting embedded and power-managed devices.

How an attack unfolds

Local attacker writes to poll_interval sysfs parameter or unbinds the driver through sysfs to trigger concurrent access to bq27xxx_battery_devices list and delayed_work requeuing, leading to use-after-free or invalid state.

How to fix it

Update the Linux kernel to include commit 4c9615474fb0a41cfad658d78db3c9ec70912969 which adds a removed flag and reorders list removal before delayed_work cancellation.

How to confirm the fix worked

Inspect kernel source for struct bq27xxx_device_info containing a removed attribute, confirm list removal precedes delayed_work cancel in remove(), and verify poll_interval is no longer zeroed in teardown().

Typical attack path

1. Obtain local shell or process execution
2. Write to /sys/module/bq27xxx_battery/parameters/poll_interval
3. Trigger driver unbind via sysfs or module unload
4. Cause concurrent delayed_work operations on the device list

How to detect it

Review kernel logs for oops, warnings, or panics mentioning bq27xxx_battery, delayed_work, or poll_interval during driver removal or sysfs writes.

What your security team should do

• Apply the referenced kernel commit or distribution backport on all affected systems
• Limit unprivileged write access to bq27xxx sysfs parameters
• Reboot or reload the module after patching to clear any pending work items