CVE-2023-53759HID: hidraw: fix data race on device refcount
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: HID: hidraw: fix data race on device refcount The hidraw_open() function increments the hidraw device reference counter. The counter has no dedicated synchronization mechanism, resulting in a potential data race when concurrently opening a device. The race is a regression introduced by commit 8590222e4b02 ("HID: hidraw: Replace hidraw device table mutex with a rwsem"). While minors_rwsem is intended to protect the hidraw_table itself, by instead acquiring the lock for writing, the reference counter is also protected. This is symmetrical to hidraw_release().
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Deferred
- Record last updated
- Aug 5, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 8590222e4b021054a7167a4dd35b152a8ed7018e builds before 879e79c3aead41b8aa2e91164354b30bd1c4ef3b; from 8590222e4b021054a7167a4dd35b152a8ed7018e before ff348eabd97577da974d3db7038857f28c61d2bd; 8590222e4b021054a7167a4dd35b152a8ed7018e builds before 05b47034e2488c2924e5c032e20a1979d012b5b5; 8590222e4b021054a7167a4dd35b152a8ed7018e builds before 944ee77dc6ec7b0afd8ec70ffc418b238c92f12b | CNA record |
References
- https://git.kernel.org/stable/c/879e79c3aead41b8aa2e91164354b30bd1c4ef3b
- https://git.kernel.org/stable/c/ff348eabd97577da974d3db7038857f28c61d2bd
- https://git.kernel.org/stable/c/05b47034e2488c2924e5c032e20a1979d012b5b5
- https://git.kernel.org/stable/c/944ee77dc6ec7b0afd8ec70ffc418b238c92f12b
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.