CVE-2023-53759

A flaw was found in the Linux kernel. A local user could exploit a data race vulnerability in the hidraw_open() function when concurrently opening a hidraw device. This issue stems from a lack of dedicated synchronization for the device reference counter. Successful exploitation could lead to a high impact on the system's confidentiality, integrity, and availability.

A moderate impact flaw was found in the Linux kernel HID subsystem as shipped in Red Hat Enterprise Linux 9. The hidraw_open() function increments the hidraw device reference counter without dedicated synchronization, so a local user with a low-privileged account could trigger a data race by concurrently opening the same hidraw device, potentially corrupting the reference count and causing a kernel crash that affects system availability. The race was introduced when the mutex protecting the hidraw device table was replaced with a reader-writer semaphore that no longer serializes reference counter updates. Red Hat Product Security rates this issue as moderate severity (CVSS 4.7, impact limited to availability), which differs from the upstream NVD rating of important (7.8) because successful exploitation requires local access, low privileges, and high attack complexity, with no direct impact on confidentiality or integrity. The vulnerable code is not present in Red Hat Enterprise Linux 7, 8, or 10, or in Red Hat In-Vehicle OS 1.1, so those products are not affected. The Red Hat Enterprise Linux 9 kernel and kernel-rt update streams currently marked affected are out of support scope.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.