CVE-2023-53054

A flaw was found in the Linux kernel's DesignWare USB 2.0 (dwc2) driver. During system power management suspend and resume cycles, the driver repeatedly registers device actions without releasing them and fails to properly balance regulator usage. A local user could trigger these operations to cause continuous memory and resource leaks, ultimately leading to a Denial of Service (DoS) due to system resource exhaustion.

A moderate severity flaw was found in the Linux kernel DesignWare USB 2.0 (dwc2) driver. On every power-management suspend/resume (low-power) cycle, the driver calls devm_add_action_or_reset() in __dwc2_lowlevel_hw_enable(), adding a new device-managed resource (devres) entry each time without releasing it, and regulator_bulk_enable() is invoked without a matching regulator_bulk_disable(), so regulator reference counts increase by one on each cycle. This can also occur at runtime because dwc2_lowlevel_hw_enable() is reachable from udc_start(). A local user with low privileges could trigger repeated low-power cycles to continuously leak kernel memory and regulator references, ultimately causing a denial of service through system resource exhaustion. The flaw affects availability only, with no impact on confidentiality or integrity (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), matching the NIST severity for this CVE. Red Hat Enterprise Linux 6, 7, 8, 9, and 10 kernel and kernel-rt, and the Hosted OpenShift (ARO/OSD) offerings, are not affected because the vulnerable code is not present in those products. The Red Hat In-Vehicle OS 1 kernel (rhivos-1.0, rhivos-1.0.z, rhivos-1.1) is affected with the fix deferred; the residual risk is limited to availability, since exploiting the leak requires local access and repeated suspend/resume cycles to gradually exhaust memory and regulator resources.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.