CVE-2023-53287 usb: cdns3: Put the cdns set active part outside the spin lock
A race condition in the Linux kernel USB driver causes a kernel warning and potential crash during device resume due to sleeping in atomic context.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-53287?
CVE-2023-53287 is a medium-severity vulnerability in Linux kernel, published on 16 Sep 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
usb: cdns3: Put the cdns set active part outside the spin lock
The device may be scheduled during the resume process, so this cannot appear in atomic operations. Since pm_runtime_set_active will resume suppliers, put set active outside the spin lock, which is only used to protect the struct cdns data structure, otherwise the kernel will report the following warning:
BUG: sleeping function called from invalid context at drivers/base/power/runtime.c:1163 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 651, name: sh preempt_count: 1, expected: 0 RCU nest depth: 0, expected: 0 CPU: 0 PID: 651 Comm: sh Tainted: G WC 6.1.20 #1 Hardware name: Freescale i.MX8QM MEK (DT) Call trace: dump_backtrace.part.0+0xe0/0xf0 show_stack+0x18/0x30 dump_stack_lvl+0x64/0x80 dump_stack+0x1c/0x38 __might_resched+0x1fc/0x240 __might_sleep+0x68/0xc0 __pm_runtime_resume+0x9c/0xe0 rpm_get_suppliers+0x68/0x1b0 __pm_runtime_set_status+0x298/0x560 cdns_resume+0xb0/0x1c0 cdns3_controller_resume.isra.0+0x1e0/0x250 cdns3_plat_resume+0x28/0x40
Which versions are affected by CVE-2023-53287?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2023-53287?
Apply the vendor's patch.
Is CVE-2023-53287 being exploited?
There is no known exploitation of CVE-2023-53287 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2023-53287, DEBIAN-CVE-2023-53287, GHSA-8p58-mprr-6r24, ROOT-OS-DEBIAN-11-CVE-2023-53287, UBUNTU-CVE-2023-53287.