CVE-2023-54207: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54207 is a use-after-free (UAF) vulnerability in the Linux kernel's HID uclogic driver, affecting the device reference handling for hidinput input device name allocation. The driver incorrectly references the input device (input_dev) instead of the HID device for devres (device resource management) allocation of the input device name string. When the input_dev is unregistered and subsequently fires a uevent that depends on the name, the name has already been freed by devres management, triggering the UAF condition. Affected Linux kernel versions span from 4.1 through 5.10.248, 5.11 through 5.15.198, 5.16 through 6.1.52, 6.2 through 6.4.15, and 6.5 through 6.5.2; Microsoft's CBL-Mariner kernel (cbl2_kernel_5.15.186.1-1) is also affected. The CVE was published on December 30, 2025, and carries a CVSS v3.1 base score of 7.8 (High) (Feedly).

The root cause is classified as CWE-416 (Use After Free). In the HID: uclogic driver, the input_dev name string was allocated using devres tied to the input_dev lifetime rather than the parent HID device. When input_dev is unregistered, devres frees the name buffer; however, a subsequent uevent triggered by the input subsystem still references the now-freed name pointer, causing a use-after-free memory access. The fix corrects the devm device reference to use the HID device (which has a longer lifetime) and simplifies the allocation logic using devm_kasprintf. Exploitation requires local access with low privileges (no user interaction needed), as an attacker must be able to interact with or trigger the unregistration of a uclogic HID input device (Feedly, Kernel Patches).

Successful exploitation of this vulnerability can result in system crashes (denial of service due to kernel memory corruption), memory corruption leading to unpredictable system behavior, and potentially arbitrary code execution with kernel-level privileges. The high confidentiality, integrity, and availability impacts reflect the risk of a kernel-space UAF being leveraged for privilege escalation or persistent access on affected Linux systems. Systems with HID uclogic driver support (used for graphics tablets and similar input devices) across a wide range of kernel versions are at risk (Feedly).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation as of the time of this report. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.023% (0.000230), indicating a very low probability of exploitation in the near term. Exploitation requires local access with low privileges, limiting the attack surface to users or processes with the ability to interact with uclogic HID devices (Feedly).

Patches are available across multiple stable kernel branches. Users should upgrade to the following fixed versions: 5.10.249 or later (for kernels 4.1–5.10), 5.15.199 or later (for 5.11–5.15), 6.1.53 or later (for 5.16–6.1), 6.4.16 or later (for 6.2–6.4), and 6.5.3 or later (for 6.5+). Patch commits include 4c2707dfee58, 51f49e3927ad, 58f0d1c0e494, dd613a4e45f8, f283805d9843, and f78bb490b16e. As a workaround for systems that cannot be immediately patched, administrators should restrict local user access, apply the principle of least privilege, and consider disabling the HID uclogic driver (CONFIG_HID_UCLOGIC) if the functionality is not required. Debian, Ubuntu, Amazon Linux, and Microsoft (CBL-Mariner) have all issued updated packages (Feedly, Debian LTS, Ubuntu USN-8162-1).