CVE-2023-53454

HID: multitouch: Correct devm device reference for hidinput input_dev name

State: Published
Severity: 8.8 High
Published: Oct 1, 2025
Updated: Oct 15, 2026
Reserved: Sep 17, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

HID: multitouch: Correct devm device reference for hidinput input_dev name

Reference the HID device rather than the input device for the devm allocation of the input_dev name. Referencing the input_dev would lead to a use-after-free when the input_dev was unregistered and subsequently fires a uevent that depends on the name. At the point of firing the uevent, the name would be freed by devres management.

Use devm_kasprintf to simplify the logic for allocating memory and formatting the input_dev name string.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	c08d46aa805ba46d501f610c2448d07bea979780 to before ac0d389402a6ff9ad92cea02c2d8c711483b91abAffected c08d46aa805ba46d501f610c2448d07bea979780 to before 39c70c19456e50dcb3abfe53539220dff0490f1dAffected c08d46aa805ba46d501f610c2448d07bea979780 to before df7ca43fe090e1a56c216c8ebc106ef5fd49afc6Affected c08d46aa805ba46d501f610c2448d07bea979780 to before 15ec7cb55e7d88755aa01d44a7a1015a42bfce86Affected c08d46aa805ba46d501f610c2448d07bea979780 to before dde88ab4e45beb60b217026207aa9c14c88d71abAffected c08d46aa805ba46d501f610c2448d07bea979780 to before 2763732ec1e68910719c75b6b896e11b6d3d622bAffected c08d46aa805ba46d501f610c2448d07bea979780 to before 1d7833db9fd118415dace2ca157bfa603dec9c8cAffected c08d46aa805ba46d501f610c2448d07bea979780 to before b70ac7849248ec8128fa12f86e3655ba38838f29Affected c08d46aa805ba46d501f610c2448d07bea979780 to before 4794394635293a3e74591351fff469cea7ad15a2Affected
LinuxLinux	3.12Affected before 3.12Not affected 4.14.326 through 4.14.Not affected 4.19.295 through 4.19.Not affected 5.4.257 through 5.4.Not affected 5.10.195 through 5.10.Not affected 5.15.132 through 5.15.Not affected 6.1.53 through 6.1.Not affected 6.4.16 through 6.4.Not affected 6.5.3 through 6.5.Not affected 6.6 and laterNot affected

Product

Versions

LinuxLinux

c08d46aa805ba46d501f610c2448d07bea979780 to before ac0d389402a6ff9ad92cea02c2d8c711483b91abAffected
c08d46aa805ba46d501f610c2448d07bea979780 to before 39c70c19456e50dcb3abfe53539220dff0490f1dAffected
c08d46aa805ba46d501f610c2448d07bea979780 to before df7ca43fe090e1a56c216c8ebc106ef5fd49afc6Affected
c08d46aa805ba46d501f610c2448d07bea979780 to before 15ec7cb55e7d88755aa01d44a7a1015a42bfce86Affected
c08d46aa805ba46d501f610c2448d07bea979780 to before dde88ab4e45beb60b217026207aa9c14c88d71abAffected
c08d46aa805ba46d501f610c2448d07bea979780 to before 2763732ec1e68910719c75b6b896e11b6d3d622bAffected
c08d46aa805ba46d501f610c2448d07bea979780 to before 1d7833db9fd118415dace2ca157bfa603dec9c8cAffected
c08d46aa805ba46d501f610c2448d07bea979780 to before b70ac7849248ec8128fa12f86e3655ba38838f29Affected
c08d46aa805ba46d501f610c2448d07bea979780 to before 4794394635293a3e74591351fff469cea7ad15a2Affected

LinuxLinux

3.12Affected
before 3.12Not affected
4.14.326 through 4.14.*Not affected
4.19.295 through 4.19.*Not affected
5.4.257 through 5.4.*Not affected
5.10.195 through 5.10.*Not affected
5.15.132 through 5.15.*Not affected
6.1.53 through 6.1.*Not affected
6.4.16 through 6.4.*Not affected
6.5.3 through 6.5.*Not affected
6.6 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.