CVE-2023-53459

HIGH EPSS 4.0%
Published Oct 1, 20259mo ago · Modified Jun 17, 20261w ago
7.8 CVSS 3.1
High
Find Similar
Published Oct 1, 2025 9mo ago
Last Modified Jun 17, 2026 1w ago

Description

In the Linux kernel, the following vulnerability has been resolved: HID: mcp-2221: prevent UAF in delayed work If the device is plugged/unplugged without giving time for mcp_init_work() to complete, we might kick in the devm free code path and thus have unavailable struct mcp_2221 while in delayed work. Canceling the delayed_work item is enough to solve the issue, because cancel_delayed_work_sync will prevent the work item to requeue itself.

CVSS Details

Base Score
7.8
Exploitability
1.8
Impact
5.9
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
4.0% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-416 Use After Free Memory Safety

Affected Products 1

VendorProductVersionRange
linuxlinux_kernel6.2any

References 2

  • git.kernel.org https://git.kernel.org/stable/c/47e91fdfa511139f2549687edb0d8649b123227b
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/5dc297652dbc557eba7ca7d6a4c5f1940dffffb1
    Patch

Remediation

  • git.kernel.org https://git.kernel.org/stable/c/47e91fdfa511139f2549687edb0d8649b123227b
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/5dc297652dbc557eba7ca7d6a4c5f1940dffffb1
    Patch