{
  "cveId": "CVE-2023-54159",
  "url": "https://patchblox.com/security/cve/CVE-2023-54159",
  "summary": "CVE-2023-54159 is fixed in linux on 1 platform, first by DEBIAN-CVE-2023-54159, released December 24, 2025. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  usb: mtu3: fix kernel panic at qmu transfer done...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  usb: mtu3: fix kernel panic at qmu transfer done irq handler  When handle qmu transfer irq, it will unlock @mtu-\u003Elock before give back request, if another thread handle disconnect event at the same time, and try to disable ep, it may lock @mtu-\u003Elock and free qmu ring, then qmu irq hanlder may get a NULL gpd, avoid the KE by checking gpd\u0027s value before handling it.  e.g. qmu done irq on cpu0                 thread running on cpu1  qmu_done_tx()   handle gpd [0]     mtu3_requ_complete()        mtu3_gadget_ep_disable()       unlock @mtu-\u003Elock         give back request         lock @mtu-\u003Elock                                     mtu3_ep_disable()                                       mtu3_gpd_ring_free()                                    unlock @mtu-\u003Elock       lock @mtu-\u003Elock     get next gpd [1]  [1]: goto [0] to handle next gpd, and next gpd may be NULL.",
  "published": "2025-12-24T13:16:17Z",
  "severity": "",
  "epss": 0.00205,
  "epssPercentile": 0.10539,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.1.37-1",
      "fix": "DEBIAN-CVE-2023-54159",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-54159",
      "released": "2025-12-24T13:16:17Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.3.7-1",
      "fix": "DEBIAN-CVE-2023-54159",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-54159",
      "released": "2025-12-24T13:16:17Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.3.7-1",
      "fix": "DEBIAN-CVE-2023-54159",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-54159",
      "released": "2025-12-24T13:16:17Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T19:12:23Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}