CVE-2023-52898: Linux Kernel

Medium severity, CVSS 4.7. EPSS: 0.2% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: xhci: Fix null pointer dereference when host dies Make sure xhci_free_dev() and xhci_kill_endpoint_urbs() do not race and cause null pointer dereference when host suddenly dies. Usb core may call xhci_free_dev() which frees the xhci->devs[slot_id] virt device at the same time that xhci_kill_endpoint_urbs() tries to loop through all the device's endpoints, checking if there are any cancelled urbs left to give back. hold the xhci spinlock while freeing the virt device

Affected products

• Linux Linux Kernel: before 4.19.271 (fixed in 4.19.271); from 4.20, before 5.4.230 (fixed in 5.4.230); from 5.5, before 5.10.165 (fixed in 5.10.165); from 5.11, before 5.15.90 (fixed in 5.15.90); from 5.16, before 6.1.8 (fixed in 6.1.8); version 6.2 only

Published 2024-08-21. Last modified 2026-06-17.