CVE-2023-54159

What it actually does

Race condition in MTU3 USB gadget QMU IRQ handler allows concurrent disconnect to free the GPD ring, resulting in NULL pointer dereference and kernel panic when the IRQ handler later accesses the next GPD.

Why it matters to the business

Unpatched Linux systems using the affected USB driver risk sudden kernel crashes during USB gadget activity, causing service outages, data loss, and unplanned reboots; exposure remains high 308 days after disclosure with no KEV listing.

How an attack unfolds

Attacker initiates QMU transfers on one CPU while triggering a gadget disconnect on another CPU; the IRQ handler unlocks the lock before request completion, allowing the disconnect path to free the ring and leave a NULL GPD for the IRQ to dereference on the next iteration.

How to fix it

Upgrade to fixed kernel versions: Debian 12 to 6.1.52-1, Debian 13/14 to 6.4.11-1, or apply commit 26ca30516b2c49dd04c134cbdf122311c538df98 from stable git; rebuild and reboot all affected hosts.

How to confirm the fix worked

Confirm running kernel version meets or exceeds listed fixed releases; search source for the added NULL GPD check before handling in qmu_done_tx(); test USB gadget attach/detach sequences for stability.

Typical attack path

1. Establish USB gadget connection that triggers QMU transfers
2. Concurrently issue disconnect or endpoint disable from another thread
3. Race window allows GPD ring free while IRQ handler walks the list
4. NULL GPD access causes kernel panic

How to detect it

Search kernel logs and crash dumps for oops traces containing mtu3_requ_complete, mtu3_gadget_ep_disable, or qmu_done_tx; correlate timestamps of USB disconnect events with subsequent panics.

What your security team should do

• Prioritize kernel package updates on all Debian and upstream Linux hosts
• Reboot after upgrade and validate USB gadget functionality
• Add kernel panic monitoring for mtu3/qmu symbols to detect residual exposure
• Review downstream dependent packages for rebuild requirements