CVE-2023-54159: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54159 is a race condition vulnerability in the Linux kernel's USB MTU3 driver that can cause a kernel panic (NULL pointer dereference) in the QMU (Queue Management Unit) transfer done interrupt handler. The flaw affects Linux kernel versions from 5.2 onward, introduced at commit 48e0d3735aa5, and was publicly disclosed on December 24, 2025. Patched versions include 5.4.243, 5.10.180, 5.15.111, 6.1.28, 6.2.15, 6.3.2, and 6.4. No CVSS score has been assigned at this time; the EPSS score is approximately 0.024% (Red Hat CVE, Feedly).

The root cause is a time-of-check/time-of-use (TOCTOU) race condition (CWE-362) in the qmu_done_tx() function of the USB MTU3 driver (drivers/usb/mtu3/). When the QMU transfer IRQ handler on CPU0 calls mtu3_requ_complete(), it temporarily releases mtu->lock to give back a completed request. Concurrently, a thread on CPU1 handling a USB disconnect event can acquire mtu->lock, call mtu3_ep_disable() → mtu3_gpd_ring_free(), and free the QMU ring. When the IRQ handler re-acquires the lock and attempts to fetch the next GPD (General Purpose Descriptor), it may dereference a NULL pointer, triggering a kernel panic. The fix adds a NULL check on the GPD value before processing it in the interrupt handler (Red Hat CVE, Feedly).

Successful triggering of this vulnerability results in a kernel panic, causing an immediate system crash and denial of service. The impact is limited to availability — there is no evidence of confidentiality or integrity compromise. Systems using the MediaTek MTU3 USB controller (common in embedded and ARM-based platforms) are at risk of unexpected reboots or unresponsiveness when USB devices are rapidly connected and disconnected (Feedly, Red Hat CVE).

• Logs: Kernel oops or panic messages in /var/log/kern.log or dmesg output referencing qmu_done_tx, mtu3_requ_complete, or NULL pointer dereference in the usb/mtu3 driver path.
• System Behavior: Unexpected system reboots or kernel panics coinciding with USB device connect/disconnect events on systems using the MTU3 USB controller.
• Process: Kernel crash dumps (if kdump is configured) containing stack traces involving mtu3_gadget_ep_disable, mtu3_ep_disable, or mtu3_gpd_ring_free.

Update the Linux kernel to a patched version: 5.4.243, 5.10.180, 5.15.111, 6.1.28, 6.2.15, 6.3.2, or 6.4 and later. As a temporary workaround, disabling the MTU3 USB driver (if not operationally required) can prevent exposure. Organizations should monitor vendor-specific distributions (e.g., Red Hat, Ubuntu, SUSE) for backported patches applicable to their supported kernel versions (Red Hat CVE, Red Hat Bugzilla).