In the Linux kernel, the following vulnerability has been resolved:

usb: early: xhci-dbc: Fix a potential out-of-bound memory access

If xdbc_bulk_write() fails, the values in 'buf' can be anything. So the
string is not guaranteed to be NULL terminated when xdbc_trace() is called.

Reserve an extra byte, which will be zeroed automatically because 'buf' is
a static variable, in order to avoid troubles, should it happen.

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00026.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
aeb9dd1de98c1a5f2007ea5d2a154c1244caf8a0 affected < e8fb0f13e45cf361fd06593d3cb2d89915cd3bd0
aeb9dd1de98c1a5f2007ea5d2a154c1244caf8a0 affected < 351c8d8650d1ccc006255fa01f98b6c6496a02e5
aeb9dd1de98c1a5f2007ea5d2a154c1244caf8a0 affected < df7c8aba7309f4dc55df94e06b67f576c0f52406
aeb9dd1de98c1a5f2007ea5d2a154c1244caf8a0 affected < a4a97ab3db5c081eb6e7dba91306adefb461e0bd
Linux Linux affected
Version Status Constraints
4.12 affected —
0 unaffected < 4.12
5.15.99 unaffected ≤ 5.15.*
6.1.16 unaffected ≤ 6.1.*
6.2.3 unaffected ≤ 6.2.*
6.3 unaffected ≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/351c8d8650d1ccc006255fa01f98b6c6496a02e5 cve-icon cve-icon
https://git.kernel.org/stable/c/a4a97ab3db5c081eb6e7dba91306adefb461e0bd cve-icon cve-icon
https://git.kernel.org/stable/c/df7c8aba7309f4dc55df94e06b67f576c0f52406 cve-icon cve-icon
https://git.kernel.org/stable/c/e8fb0f13e45cf361fd06593d3cb2d89915cd3bd0 cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2025120957-CVE-2023-53840-797d@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2023-53840 cve-icon
https://www.cve.org/CVERecord?id=CVE-2023-53840 cve-icon
History

Wed, 10 Dec 2025 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

threat_severity

Important

Tue, 09 Dec 2025 02:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: usb: early: xhci-dbc: Fix a potential out-of-bound memory access If xdbc_bulk_write() fails, the values in 'buf' can be anything. So the string is not guaranteed to be NULL terminated when xdbc_trace() is called. Reserve an extra byte, which will be zeroed automatically because 'buf' is a static variable, in order to avoid troubles, should it happen.
Title usb: early: xhci-dbc: Fix a potential out-of-bound memory access
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2025-12-09T01:29:56.848Z

Reserved: 2025-12-09T01:27:17.826Z

Link: CVE-2023-53840

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-12-09T16:17:23.667

Modified: 2025-12-09T18:37:13.640

Link: CVE-2023-53840

cve-icon Redhat

Severity : Important

Publid Date: 2025-12-09T00:00:00Z

Links: CVE-2023-53840 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.