In the Linux kernel, the following vulnerability has been resolved:
usb: mtu3: fix kernel panic at qmu transfer done irq handler
When handle qmu transfer irq, it will unlock @mtu->lock before give back request, if another thread handle disconnect event at the same time, and try to disable ep, it may lock @mtu->lock and free qmu ring, then qmu irq hanlder may get a NULL gpd, avoid the KE by checking gpd's value before handling it.
e.g. qmu done irq on cpu0 thread running on cpu1
qmudonetx() handle gpd [0] mtu3requcomplete() mtu3gadgetepdisable() unlock @mtu->lock give back request lock @mtu->lock mtu3epdisable() mtu3gpdringfree() unlock @mtu->lock lock @mtu->lock get next gpd [1]
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/54xxx/CVE-2023-54159.json",
"cna_assigner": "Linux"
}