CVE-2023-53580

A deadlock flaw was found in the Linux kernel's USB Gadget subsystem in the driver unbind path. A local privileged user can trigger this issue by removing a UVC gadget driver from a gadget configuration, causing the unbind callback to call usb_gadget_deactivate while the caller holds the connect_lock mutex. This results in a deadlock attempting to reacquire the same mutex, leading to a kernel panic or system hang.

The gadget_unbind_driver function calls the driver's unbind callback while holding the udc->connect_lock mutex. When the UVC gadget driver's unbind function calls usb_gadget_deactivate as part of its cleanup, that function attempts to acquire the same mutex, creating a classic self-deadlock. This issue was exposed by the interaction between kernel components and userspace in UVC gadget configurations. The fix is straightforward—drop the mutex before invoking the unbind callback, which matches the pattern used for bind callbacks.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the usb_f_uvc module from being loaded. See https://access.redhat.com/solutions/41278 for instructions on blacklisting kernel modules.