CVE-2023-53759

HID: hidraw: fix data race on device refcount

HIGH
7.8
CVSS Score
Published: December 8, 2025 at 01:19 AM UTC
Updated: August 5, 2026 at 10:24 AM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
HIGH7.8
Exploit prediction
EPSS 0.1%

Description

In the Linux kernel, the following vulnerability has been resolved: HID: hidraw: fix data race on device refcount The hidraw_open() function increments the hidraw device reference counter. The counter has no dedicated synchronization mechanism, resulting in a potential data race when concurrently opening a device. The race is a regression introduced by commit 8590222e4b02 ("HID: hidraw: Replace hidraw device table mutex with a rwsem"). While minors_rwsem is intended to protect the hidraw_table itself, by instead acquiring the lock for writing, the reference counter is also protected. This is symmetrical to hidraw_release().

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

5.17 ≤ v < 6.1.375.17 ≤ v < 6.3.115.17 ≤ v < 6.4.15.17 ≤ v < 6.55.178590222e4b021054a7167a4dd35b152a8ed7018e
Vendor states this is fixed in 05b47034e2488c2924e5c032e20a1979d012b5b5 (fixed)
Vendor states this is fixed in 879e79c3aead41b8aa2e91164354b30bd1c4ef3b (fixed)
Vendor states this is fixed in 944ee77dc6ec7b0afd8ec70ffc418b238c92f12b (fixed)
Vendor states this is fixed in ff348eabd97577da974d3db7038857f28c61d2bd (fixed)
Vendor states this is fixed in 5.17 (unaffected)
Vendor states this is fixed in 6.1.37 (unaffected)
Vendor states this is fixed in 6.3.11 (unaffected)
Vendor states this is fixed in 6.4.1 (unaffected)
Vendor states this is fixed in 6.5 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

CVSS

7.8HIGHLinux
Vector?

Quick Info

StatusDEFERRED

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card