Executive brief
A vulnerability exists in the Linux kernel's Tegra USB 3.0 host controller PHY driver that fails to properly clean up driver references when destroying dual-role USB ports. This can lead to a use-after-free condition detected by kernel sanitizers, potentially causing kernel crashes or undefined behavior on systems using affected Tegra hardware for USB connectivity.
Technical details
The vulnerability is a use-after-free bug in the Tegra xusb PHY driver (drivers/phy/tegra/xusb.c). When handling dual-role USB ports, the driver assigns the port device's driver structure to the USB PHY device. However, during port destruction via tegra_xusb_port_unregister(), the driver reference is not cleared from the USB PHY device before the port device and its driver are destroyed. This leaves a dangling pointer that causes KASAN (Kernel Address Sanitizer) to detect use-after-free issues. The fix is a single-line patch that sets port->usb_phy.dev->driver to NULL after calling usb_remove_phy(). No authentication or user interaction is required—the condition is triggered by normal port removal during device shutdown or hotplug events.
Affected products
- Linux Linux Kernel Multiple versions prior to patched releases in linux-5.15.y, linux-6.1.y, and later stable branches
Timeline
- 2023-06-09: disclosed
- 2023-07-19: patched: Fix committed upstream and backported to stable branches
- 2025-12-24: advisory