CVE-2023-53759: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-53759 is a data race vulnerability in the Linux kernel's HID (Human Interface Device) hidraw subsystem, specifically in the hidraw_open() function. The flaw arises because the hidraw device reference counter is incremented without proper synchronization, enabling a race condition when multiple processes concurrently open a device. It was introduced as a regression by commit 8590222e4b02 ("HID: hidraw: Replace hidraw device table mutex with a rwsem") and affects Linux kernel versions from 5.17 up to the patched releases (6.1.37, 6.3.11, 6.4.1, and 6.5). The vulnerability was publicly disclosed on December 8, 2025, and carries a CVSS v3.1 base score of 7.0 (High) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a classic race condition (CWE-362: Concurrent Execution Using Shared Resource with Improper Synchronization) in the hidraw_open() function of the Linux kernel's drivers/hid/hidraw.c. When the hidraw device table mutex was replaced with a read-write semaphore (minors_rwsem) by commit 8590222e4b02, the reference counter increment in hidraw_open() was left unprotected — unlike hidraw_release(), which acquires the write lock and thus protects the counter symmetrically. An attacker with local access can trigger concurrent open() calls on a hidraw device to race the unsynchronized reference counter, potentially causing use-after-free or other memory corruption conditions. The fix involves acquiring minors_rwsem for writing in hidraw_open() to match the protection already present in hidraw_release() (Red Hat Bugzilla).

Successful exploitation could result in high confidentiality, integrity, and availability impact on the affected system. A local attacker with low privileges could manipulate device reference counts, potentially leading to use-after-free memory corruption, system instability or crashes, unauthorized access to sensitive kernel memory, or disruption of HID device interactions. The vulnerability is confined to the local system (scope unchanged) and does not directly enable remote exploitation or lateral movement, but kernel-level memory corruption could be leveraged for local privilege escalation (Red Hat Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Red Hat Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), reflecting a very low probability of exploitation in the near term. Exploitation requires local access and low privileges, and the race condition nature of the flaw makes reliable exploitation technically challenging.

The fix is available in upstream Linux kernel stable releases: 6.1.37, 6.3.11, 6.4.1, and 6.5. Users should update to the latest patched kernel version provided by their Linux distribution (e.g., via SUSE, Red Hat, or upstream stable channels). As a compensating control, limiting local user access to HID raw devices (e.g., via udev rules restricting /dev/hidraw* permissions) can reduce exposure. Monitoring for unusual device interaction patterns is also recommended (Red Hat Bugzilla, Red Hat Advisory).