Executive brief
The Linux kernel's USB gadget subsystem contains a deadlock vulnerability that occurs when certain gadget drivers (specifically UVC) are unconfigured. This can cause the system to hang during device removal or reconfiguration, affecting devices that use USB gadget functionality such as Android devices, embedded Linux systems, or USB peripheral devices.
Technical details
A deadlock occurs in the gadget_unbind_driver() function when it calls the driver's unbind() callback while holding the udc->connect_lock mutex. If the gadget driver attempts to call usb_gadget_deactivate() during unbind (as the UVC gadget driver does), it will attempt to acquire the same mutex, resulting in a deadlock. The fix involves releasing the mutex before invoking the unbind() callback and reacquiring it afterward, mirroring the behavior during bind(). The patch also adds documentation clarifying that usb_gadget_activate() and usb_gadget_deactivate() must not be called from interrupt context, such as from a gadget driver's disconnect() callback.
Affected products
- Linux Linux kernel multiple versions affected; fix available in commit 65dadb2beeb7360232b09ebc4585b54475dfee06 (2023-07-29)
Timeline
- 2023-07-29: disclosed: Fix commit authored
- 2023-08-04: patched: Fix merged into stable tree
- 2025-10-04: advisory: CVE-2023-53580 published