CVE-2023-53840 usb: early: xhci-dbc: Fix a potential out-of-bound memory access
A missing null terminator in the Linux kernel xhci-dbc driver can cause out-of-bounds memory access, potentially leading to crashes or code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-53840?
CVE-2023-53840 is a memory corruption vulnerability in Linux, published on 9 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
usb: early: xhci-dbc: Fix a potential out-of-bound memory access
If xdbc_bulk_write() fails, the values in 'buf' can be anything. So the string is not guaranteed to be NULL terminated when xdbc_trace() is called.
Reserve an extra byte, which will be zeroed automatically because 'buf' is a static variable, in order to avoid troubles, should it happen.
Which versions are affected by CVE-2023-53840?
How do I fix CVE-2023-53840?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2023-53840 being exploited?
There is no known exploitation of CVE-2023-53840 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2023-53840, DEBIAN-CVE-2023-53840, GHSA-x48h-3p3j-rpqg, ROOT-OS-DEBIAN-11-CVE-2023-53840, UBUNTU-CVE-2023-53840.