CVE-2023-54083: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54083 is a use-after-free vulnerability in the Linux kernel's Tegra XUSB PHY driver (phy/tegra/xusb.c). The flaw arises because, for dual-role USB ports, the port device's driver reference is assigned to the usb-phy device but is not cleared when the port device is destroyed, leaving a dangling pointer that can trigger a use-after-free condition detectable via KASAN. The vulnerability was published on December 24, 2025, and affects Linux kernel versions starting from 5.7 up through the patch releases in the 5.10, 5.15, 6.1, 6.4, and 6.5 stable series. No CVSS score has been assigned at this time, and the EPSS score is extremely low at 0.018% (Feedly, EUVD).

The root cause is a missing cleanup step in the Tegra XUSB PHY driver's port teardown path, classified as a use-after-free (CWE-416). When a dual-role port is initialized, the port device's driver pointer (dev->driver) is assigned to the associated usb-phy device. Upon destruction of the port device, the kernel frees the driver structure, but the usb-phy device still holds a reference to it. Any subsequent access through the usb-phy device's driver pointer dereferences freed memory. The fix involves explicitly clearing the driver reference in the usb-phy device during port teardown, as implemented across multiple stable kernel branches (Feedly, EUVD).

Successful exploitation of this vulnerability could allow a local attacker or a kernel code path to read from or write to freed memory, potentially leading to kernel crashes (denial of service) or, in more sophisticated scenarios, privilege escalation or information disclosure. The impact is confined to systems using NVIDIA Tegra SoCs with the XUSB dual-role PHY driver, limiting the affected asset scope primarily to embedded and ARM-based platforms running affected Linux kernel versions. Lateral movement is not directly facilitated by this vulnerability, but kernel-level compromise could enable further privilege abuse (Feedly).

The Linux kernel maintainers have released patches across multiple stable branches. Fixed versions include Linux 5.10.188, 5.15.121, 6.1.39, 6.4.4, and 6.5. Users running affected Tegra-based systems should update to the appropriate patched kernel version for their branch. The relevant upstream commits are available at the kernel stable repository (EUVD). SUSE has also issued a kernel security advisory (SUSE-2026-0281) addressing this and related CVEs for its distributions (Linux Security).