CVE-2023-53054

Q: What is the severity of CVE-2023-53054?

CVE-2023-53054 has a CVSS score of 5.5 (MEDIUM). This CVE describes a memory leak and resource management vulnerability in the Linux kernel's DWC2 USB driver. Each time a device enters low-power mode (suspend/resume cycles), the driver fails to properly release resources, causing gradual memory exhaustion and regulator reference count inflation. This affects Linux systems using the DWC2 USB controller hardware.

5.5 MEDIUM

📋 TL;DR

This CVE describes a memory leak and resource management vulnerability in the Linux kernel's DWC2 USB driver. Each time a device enters low-power mode (suspend/resume cycles), the driver fails to properly release resources, causing gradual memory exhaustion and regulator reference count inflation. This affects Linux systems using the DWC2 USB controller hardware.

💻 Affected Systems

Products:

Linux kernel

Versions: Kernel versions with the vulnerable DWC2 driver code (specific versions not provided in CVE, but patches available for stable branches)

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems with DWC2 USB controller hardware. The vulnerability triggers during suspend/resume cycles or USB gadget mode operations.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Continuous memory exhaustion leading to kernel OOM (Out of Memory) conditions, system instability, and potential denial of service through resource starvation.

🟠

Likely Case

Gradual memory leak causing performance degradation over time, especially on embedded/IoT devices with frequent power state changes, eventually requiring system reboot.

🟢

If Mitigated

With proper patching, no impact as the resource management is fixed.

🌐 Internet-Facing: LOW - This is a local kernel driver issue requiring physical or local access to trigger through power management operations.

🏢 Internal Only: MEDIUM - Affects systems with DWC2 USB hardware that undergo frequent suspend/resume cycles, particularly embedded devices and servers with USB peripherals.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: NO

Unauthenticated Exploit: ✅ No

Complexity: LOW - Triggering requires ability to initiate suspend/resume cycles or USB gadget operations.

Exploitation requires local access to trigger power management operations. No remote exploitation vector identified.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Patches available in stable kernel branches (commits: 1f01027c51eb, 6485fc381b65, cba76e1fb896, f747313249b7, ffb8ab6f87bd)

Vendor Advisory: https://git.kernel.org/stable/c/1f01027c51eb16145e8e07fafea3ca07ef102d06

Restart Required: Yes

Instructions:

1. Update to a patched kernel version from your distribution vendor. 2. Apply kernel patches manually if compiling from source. 3. Reboot system after kernel update.

🔧 Temporary Workarounds

Disable USB suspend/resume

linux

Prevent USB controller from entering low-power states to avoid triggering the leak

echo 'on' > /sys/bus/usb/devices/*/power/control
echo '0' > /sys/module/usbcore/parameters/autosuspend

Disable DWC2 USB gadget mode

linux

If not using USB peripheral functionality, disable gadget mode to reduce exposure

modprobe -r dwc2
echo 'blacklist dwc2' > /etc/modprobe.d/disable-dwc2.conf

🧯 If You Can't Patch

Monitor system memory usage and implement automatic reboot thresholds
Disable USB suspend features and keep USB controllers in active state

🔍 How to Verify

Check if Vulnerable:

Check if DWC2 driver is loaded and system undergoes suspend/resume: lsmod | grep dwc2 && dmesg | grep -i 'dwc2.*suspend\|resume'

Check Version:

uname -r

Verify Fix Applied:

Check kernel version includes patched commits: uname -r && zgrep -i 'dwc2.*leak\|CVE-2023-53054' /proc/version /boot/*

📡 Detection & Monitoring

Log Indicators:

Kernel OOM messages
Increasing memory usage in /proc/meminfo
devres_log entries showing repeated ADD without REMOVE

Network Indicators:

None - local vulnerability only

SIEM Query:

source="kernel" AND ("Out of memory" OR "oom" OR "dwc2" AND "suspend")

📊 Metadata

CVE ID: CVE-2023-53054

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-401

EPSS Score: 0.02% exploit probability (5.7th percentile)

Published: May 2, 2025

Last Updated: November 12, 2025

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable USB suspend/resume

Disable DWC2 USB gadget mode

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities