PT-2025-18809 · Linux+3 · Linux Kernel+3
Published
2023-03-02
·
Updated
2026-01-28
·
CVE-2023-53045
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
A vulnerability in the Linux kernel has been resolved, related to the usb: gadget: u audio component. The issue occurs when userspace can block the driver unbind, causing a deadlock during reboot. This happens because the call to unbind may wait indefinitely for all resources to be released, which is dependent on the refcount falling to zero. Userspace can keep the refcount incremented by not closing the relevant file descriptor. The problem can be observed by opening the card with arecord and then stopping the process through the shell before unbinding.
Recommendations
To fix the problem, use
snd card free when closed() instead of snd card free(), which will disconnect the card as desired but defer the task of freeing the resources to the core once userspace closes its file descriptor.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Improper Locking
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Astra Linux
Linux Kernel
Red Os
Suse