CVE-2023-54079: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54079 is a race condition vulnerability in the Linux kernel's bq27xxx battery power supply driver (power: supply: bq27xxx). The flaw involves improper handling of poll_interval and concurrent access races during device removal, introduced from Linux kernel version 3.3 onward. Patches were backported to stable branches including 4.14.316, 4.19.284, 5.4.244, 5.10.181, 5.15.114, 6.1.31, 6.3.5, and 6.4. It was published on December 24, 2025, with an EPSS score of approximately 0.024% (very low), and no CVSS score has been formally assigned (Feedly, ENISA EUVD).

The root cause is a time-of-check/time-of-use (TOCTOU) race condition (CWE-362) in the bq27xxx_battery Linux kernel driver. Two distinct races exist: first, bq27xxx_battery_teardown() set poll_interval = 0 to prevent the delayed work item from being requeued, but this value could be overwritten via /sys/module/bq27xxx_battery/parameters/poll_interval before bq27xxx_battery_update() checked it, and also unexpectedly altered the global parameter when the driver was unbound via sysfs rather than via rmmod. Second, during remove(), writing to the poll_interval sysfs parameter could requeue the delayed work item for all devices on the bq27xxx_battery_devices list, including the device being removed, because removal from the list occurred only after cancellation of the delayed work. The fix introduces a removed flag in struct bq27xxx_device_info and reorders list removal to precede work cancellation (Feedly).

Exploitation of this race condition could lead to use-after-free or undefined kernel behavior during device unbind or module removal, potentially causing a kernel crash (denial of service) or, in edge cases, memory corruption. The vulnerability is local in scope, affecting systems with the bq27xxx battery gauge driver loaded, which is primarily relevant to embedded Linux devices and systems using Texas Instruments BQ27xxx fuel gauge ICs. There is no known path to privilege escalation or remote code execution based on available information (Feedly).

Apply the upstream kernel patches that introduce the removed flag in struct bq27xxx_device_info and reorder device list removal relative to work cancellation. Fixed versions are available in stable branches: Linux 4.14.316, 4.19.284, 5.4.244, 5.10.181, 5.15.114, 6.1.31, 6.3.5, and 6.4. Users should update to a patched kernel version provided by their Linux distribution. As a temporary workaround, avoiding dynamic unbinding of the bq27xxx_battery driver via sysfs (preferring module removal via rmmod) reduces exposure to one of the two race conditions (Feedly, ENISA EUVD).