CVE-2023-52855

In the Linux kernel, the following vulnerability has been resolved: usb: dwc2: fix possible NULL pointer dereference caused by driver concurrency In _dwc2_hcd_urb_enqueue(), "urb->hcpriv = NULL" is executed without holding the lock "hsotg->lock". In _dwc2_hcd_urb_dequeue(): spin_lock_irqsave(&hsotg->lock, flags); ... if (!urb->hcpriv) { dev_dbg(hsotg->dev, "## urb->hcpriv is NULL ##\n"); goto out; } rc = dwc2_hcd_urb_dequeue(hsotg, urb->hcpriv); // Use urb->hcpriv ... out: spin_unlock_irqrestore(&hsotg->lock, flags); When _dwc2_hcd_urb_enqueue() and _dwc2_hcd_urb_dequeue() are concurrently executed, the NULL check of "urb->hcpriv" can be executed before "urb->hcpriv = NULL". After urb->hcpriv is NULL, it can be used in the function call to dwc2_hcd_urb_dequeue(), which can cause a NULL pointer dereference. This possible bug is found by an experimental static analysis tool developed by myself. This tool analyzes the locking APIs to extract function pairs that can be concurrently executed, and then analyzes the instructions in the paired functions to identify possible concurrency bugs including data races and atomicity violations. The above possible bug is reported, when my tool analyzes the source code of Linux 6.5. To fix this possible bug, "urb->hcpriv = NULL" should be executed with holding the lock "hsotg->lock". After using this patch, my tool never reports the possible bug, with the kernelconfiguration allyesconfig for x86_64. Because I have no associated hardware, I cannot test the patch in runtime testing, and just verify it according to the code logic.

• CWE-476

• https://git.kernel.org/stable/c/14c9ec34e8118fbffd7f5431814d767726323e72Patch
• https://git.kernel.org/stable/c/3e851a77a13ce944d703721793f49ee82622986dPatch
• https://git.kernel.org/stable/c/64c47749fc7507ed732e155c958253968c1d275ePatch
• https://git.kernel.org/stable/c/6b21a22728852d020a6658d39cd7bb7e14b07790Patch
• https://git.kernel.org/stable/c/a7bee9598afb38004841a41dd8fe68c1faff4e90Patch
• https://git.kernel.org/stable/c/bdb3dd4096302d6b87441fdc528439f171b04be6Patch
• https://git.kernel.org/stable/c/ef307bc6ef04e8c1ea843231db58e3afaafa9fa6Patch
• https://git.kernel.org/stable/c/fcaafb574fc88a52dce817f039f7ff2f9da38001Patch
• https://git.kernel.org/stable/c/fed492aa6493a91a77ebd51da6fb939c98d94a0dPatch
• https://git.kernel.org/stable/c/14c9ec34e8118fbffd7f5431814d767726323e72Patch
• https://git.kernel.org/stable/c/3e851a77a13ce944d703721793f49ee82622986dPatch
• https://git.kernel.org/stable/c/64c47749fc7507ed732e155c958253968c1d275ePatch
• https://git.kernel.org/stable/c/6b21a22728852d020a6658d39cd7bb7e14b07790Patch
• https://git.kernel.org/stable/c/a7bee9598afb38004841a41dd8fe68c1faff4e90Patch
• https://git.kernel.org/stable/c/bdb3dd4096302d6b87441fdc528439f171b04be6Patch
• https://git.kernel.org/stable/c/ef307bc6ef04e8c1ea843231db58e3afaafa9fa6Patch
• https://git.kernel.org/stable/c/fcaafb574fc88a52dce817f039f7ff2f9da38001Patch
• https://git.kernel.org/stable/c/fed492aa6493a91a77ebd51da6fb939c98d94a0dPatch

Published

May 21, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-5285A vulnerability classified as critical was found in Tongda O…7.5
• CVE-2023-52850In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2023-52851In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2023-52852In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2023-52853In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2023-52854In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2023-52856In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2023-52857In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2023-52858In the Linux kernel, the following vulnerability has been re…6.2
• CVE-2023-52859In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2023-5286A vulnerability, which was classified as problematic, has be…5.4
• CVE-2023-52860In the Linux kernel, the following vulnerability has been re…5.5