CVE-2023-54083 in Linux
Summary
by MITRE • 12/24/2025
In the Linux kernel, the following vulnerability has been resolved:
phy: tegra: xusb: Clear the driver reference in usb-phy dev
For the dual-role port, it will assign the phy dev to usb-phy dev and use the port dev driver as the dev driver of usb-phy.
When we try to destroy the port dev, it will destroy its dev driver as well. But we did not remove the reference from usb-phy dev. This might cause the use-after-free issue in KASAN.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 01/02/2026
The vulnerability CVE-2023-54083 affects the Linux kernel's USB phy driver implementation, specifically within the tegra xusb subsystem. This issue manifests as a use-after-free condition that occurs during the cleanup process of USB dual-role ports. The problem stems from improper reference management between USB phy devices and their associated driver contexts, creating a scenario where memory corruption can occur during system shutdown or device removal operations.
The technical flaw exists in the handling of device driver references within the USB phy subsystem. When a dual-role port is initialized, the system assigns the phy device to the usb-phy device and establishes the port device driver as the driver context for the usb-phy device. However, during the destruction phase of the port device, the system properly cleans up the port device driver but fails to remove the corresponding reference from the usb-phy device. This creates a dangling pointer scenario where the usb-phy device continues to reference a driver that has already been freed, leading to potential memory access violations.
The operational impact of this vulnerability is significant for embedded systems and devices that utilize NVIDIA Tegra SoCs with USB dual-role capabilities. Systems running affected Linux kernel versions may experience kernel crashes, system instability, or memory corruption when USB devices are removed or when the system undergoes shutdown procedures. The use-after-free condition can potentially be exploited to escalate privileges or cause denial of service attacks, particularly in environments where USB device management is frequent or automated. This vulnerability affects the kernel's memory management subsystem and can compromise the overall system reliability.
This issue maps to CWE-416, which describes the use of freed memory vulnerability, and aligns with ATT&CK technique T1068, which covers the exploitation of local privilege escalation through kernel vulnerabilities. The fix implemented addresses the reference counting mechanism by ensuring proper cleanup of driver references during device destruction. Organizations should prioritize updating their Linux kernel versions to include the patched implementation, particularly those operating embedded systems, automotive platforms, or devices with USB connectivity that may be subject to frequent device insertion/removal cycles. The mitigation strategy involves applying the kernel patch that properly clears the driver reference in usb-phy devices during cleanup operations, preventing the dangling pointer condition that leads to the use-after-free scenario.