In the Linux kernel, the following vulnerability has been resolved:

phy: tegra: xusb: Clear the driver reference in usb-phy dev

For the dual-role port, it will assign the phy dev to usb-phy dev and
use the port dev driver as the dev driver of usb-phy.

When we try to destroy the port dev, it will destroy its dev driver
as well. But we did not remove the reference from usb-phy dev. This
might cause the use-after-free issue in KASAN.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00027.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
e8f7d2f409a15c519d5a6085777d85c1c4bab73a affected < b6a107c52073496d2e5d2837915f59fb3103832f
e8f7d2f409a15c519d5a6085777d85c1c4bab73a affected < b84998a407a882991916b1a61d987c400d8a0ce6
e8f7d2f409a15c519d5a6085777d85c1c4bab73a affected < 238edc04ddb9d272b38f5419bcd419ad3b92b91b
e8f7d2f409a15c519d5a6085777d85c1c4bab73a affected < 82187460347ad58fd6b06d2883da73c3f2df9631
e8f7d2f409a15c519d5a6085777d85c1c4bab73a affected < c0c2fcb1325d0d4f3b322b5ee49385f8eca2560d
Linux Linux affected
Version Status Constraints
5.7 affected —
0 unaffected < 5.7
5.10.188 unaffected ≤ 5.10.*
5.15.121 unaffected ≤ 5.15.*
6.1.39 unaffected ≤ 6.1.*
6.4.4 unaffected ≤ 6.4.*
6.5 unaffected ≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/238edc04ddb9d272b38f5419bcd419ad3b92b91b cve-icon cve-icon
https://git.kernel.org/stable/c/82187460347ad58fd6b06d2883da73c3f2df9631 cve-icon cve-icon
https://git.kernel.org/stable/c/b6a107c52073496d2e5d2837915f59fb3103832f cve-icon cve-icon
https://git.kernel.org/stable/c/b84998a407a882991916b1a61d987c400d8a0ce6 cve-icon cve-icon
https://git.kernel.org/stable/c/c0c2fcb1325d0d4f3b322b5ee49385f8eca2560d cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2025122404-CVE-2023-54083-fc0e@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2023-54083 cve-icon
https://www.cve.org/CVERecord?id=CVE-2023-54083 cve-icon
History

Thu, 25 Dec 2025 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Low

Wed, 24 Dec 2025 13:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: phy: tegra: xusb: Clear the driver reference in usb-phy dev For the dual-role port, it will assign the phy dev to usb-phy dev and use the port dev driver as the dev driver of usb-phy. When we try to destroy the port dev, it will destroy its dev driver as well. But we did not remove the reference from usb-phy dev. This might cause the use-after-free issue in KASAN.
Title phy: tegra: xusb: Clear the driver reference in usb-phy dev
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2025-12-24T13:06:14.771Z

Reserved: 2025-12-24T13:02:52.515Z

Link: CVE-2023-54083

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-12-24T13:16:10.147

Modified: 2025-12-29T15:58:34.503

Link: CVE-2023-54083

cve-icon Redhat

Severity : Low

Publid Date: 2025-12-24T00:00:00Z

Links: CVE-2023-54083 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.