CVE-2023-53693 in Linux
Summary
by MITRE • 10/22/2025
In the Linux kernel, the following vulnerability has been resolved:
USB: gadget: Fix the memory leak in raw_gadget driver
Currently, increasing raw_dev->count happens before invoke the raw_queue_event(), if the raw_queue_event() return error, invoke raw_release() will not trigger the dev_free() to be called.
[ 268.905865][ T5067] raw-gadget.0 gadget.0: failed to queue event
[ 268.912053][ T5067] udc dummy_udc.0: failed to start USB Raw Gadget: -12
[ 268.918885][ T5067] raw-gadget.0: probe of gadget.0 failed with error -12
[ 268.925956][ T5067] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[ 268.934657][ T5067] misc raw-gadget: fail, usb_gadget_register_driver returned -16
BUG: memory leak
[] kmalloc_trace+0x24/0x90 mm/slab_common.c:1076
[] kmalloc include/linux/slab.h:582 [inline]
[] kzalloc include/linux/slab.h:703 [inline]
[] dev_new drivers/usb/gadget/legacy/raw_gadget.c:191 [inline]
[] raw_open+0x45/0x110 drivers/usb/gadget/legacy/raw_gadget.c:385
[] misc_open+0x1a9/0x1f0 drivers/char/misc.c:165
[] kmalloc_trace+0x24/0x90 mm/slab_common.c:1076
[] kmalloc include/linux/slab.h:582 [inline]
[] raw_ioctl_init+0xdf/0x410 drivers/usb/gadget/legacy/raw_gadget.c:460
[] raw_ioctl+0x5f9/0x1120 drivers/usb/gadget/legacy/raw_gadget.c:1250
[] vfs_ioctl fs/ioctl.c:51 [inline]
[] kmalloc_trace+0x24/0x90 mm/slab_common.c:1076
[] kmalloc include/linux/slab.h:582 [inline]
[] kzalloc include/linux/slab.h:703 [inline]
[] dummy_alloc_request+0x5a/0xe0 drivers/usb/gadget/udc/dummy_hcd.c:665
[] usb_ep_alloc_request+0x22/0xd0 drivers/usb/gadget/udc/core.c:196
[] gadget_bind+0x6d/0x370 drivers/usb/gadget/legacy/raw_gadget.c:292
This commit therefore invoke kref_get() under the condition that raw_queue_event() return success.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 02/28/2026
The vulnerability identified as CVE-2023-53693 represents a memory leak in the Linux kernel's USB raw gadget driver implementation. This flaw specifically affects the legacy raw_gadget driver component within the USB gadget framework, which provides a simplified interface for USB gadget functionality. The issue stems from improper resource management during the driver initialization and event queuing process, creating a condition where allocated memory remains unreleased when certain error conditions occur. The vulnerability manifests when the raw_gadget driver attempts to establish a USB gadget connection but encounters failures during event queueing operations, leading to memory consumption that persists beyond the intended lifecycle of the driver instance.
The technical root cause of this vulnerability lies in the sequence of operations within the driver's initialization flow. According to the kernel analysis, the increment operation for raw_dev->count occurs before the invocation of raw_queue_event() function. When raw_queue_event() returns an error condition, typically indicating a failure to queue the event, the subsequent raw_release() function does not trigger the dev_free() cleanup routine that would normally release the allocated memory resources. This improper ordering creates a memory leak scenario where kernel memory allocated through kmalloc operations remains allocated and unrecoverable. The call stack analysis demonstrates that memory allocation occurs through multiple kernel subsystems including slab allocator functions, device creation routines, and USB endpoint request allocation mechanisms, all pointing to the core issue in the raw_gadget driver's resource management logic.
The operational impact of this memory leak vulnerability extends beyond simple resource consumption, potentially leading to system instability and performance degradation over time. As the raw gadget driver is frequently used in embedded systems, development environments, and testing scenarios where USB gadget functionality is actively employed, repeated use of the vulnerable driver can cause progressive memory exhaustion. This can result in system slowdowns, application failures, or even complete system crashes when memory resources become depleted. The vulnerability affects systems running Linux kernel versions where the raw_gadget driver is present, particularly those implementing USB gadget functionality through the legacy interface. The error codes observed in the logs including -12 (ENOMEM) and -16 (EBUSY) indicate that the memory leak typically occurs during resource allocation failures, making the vulnerability exploitable in scenarios where USB gadget initialization is attempted under resource-constrained conditions.
Security implications of this vulnerability align with CWE-401, which addresses improper resource management and memory leaks in software systems. The flaw represents a classic case of resource leak where kernel memory allocated through the slab allocator is not properly released, creating potential denial of service conditions. From an ATT&CK framework perspective, this vulnerability could be leveraged by adversaries to perform resource exhaustion attacks, potentially leading to system instability or service disruption. The vulnerability does not directly enable privilege escalation or code execution, but its cumulative effect can create conditions that make other exploits more successful or simply degrade system performance. The fix implemented in this CVE addresses the issue by ensuring that kref_get() operations are only performed when raw_queue_event() successfully completes, thereby guaranteeing proper reference counting and resource management throughout the driver lifecycle. This mitigation aligns with best practices for kernel driver development, specifically emphasizing the importance of proper error handling and resource cleanup in concurrent systems where memory management is critical for overall system stability.