Riskcovery

CVE-2023-53459

HID: mcp-2221: prevent UAF in delayed work

State
Published
Severity
Not scored
Published
Oct 1, 2025
Updated
May 11, 2026
Reserved
Oct 1, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

HID: mcp-2221: prevent UAF in delayed work

If the device is plugged/unplugged without giving time for mcp_init_work() to complete, we might kick in the devm free code path and thus have unavailable struct mcp_2221 while in delayed work.

Canceling the delayed_work item is enough to solve the issue, because cancel_delayed_work_sync will prevent the work item to requeue itself.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 960f9df7c620ecb6030aff1d9a6c3d67598b8290 to before 5dc297652dbc557eba7ca7d6a4c5f1940dffffb1Affected
  • 960f9df7c620ecb6030aff1d9a6c3d67598b8290 to before 47e91fdfa511139f2549687edb0d8649b123227bAffected
LinuxLinux
  • 6.2Affected
  • before 6.2Not affected
  • 6.2.1 through 6.2.*Not affected
  • 6.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.