CVE-2023-53168

Severity CVSS v4.0:
Pending analysis
Type:
CWE-476 NULL Pointer Dereference
Publication date:
15/09/2025
Last modified:
24/11/2025

Description

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> usb: ucsi_acpi: Increase the command completion timeout<br /> <br /> Commit 130a96d698d7 ("usb: typec: ucsi: acpi: Increase command<br /> completion timeout value") increased the timeout from 5 seconds<br /> to 60 seconds due to issues related to alternate mode discovery.<br /> <br /> After the alternate mode discovery switch to polled mode<br /> the timeout was reduced, but instead of being set back to<br /> 5 seconds it was reduced to 1 second.<br /> <br /> This is causing problems when using a Lenovo ThinkPad X1 yoga gen7<br /> connected over Type-C to a LG 27UL850-W (charging DP over Type-C).<br /> <br /> When the monitor is already connected at boot the following error<br /> is logged: "PPM init failed (-110)", /sys/class/typec is empty and<br /> on unplugging the NULL pointer deref fixed earlier in this series<br /> happens.<br /> <br /> When the monitor is connected after boot the following error<br /> is logged instead: "GET_CONNECTOR_STATUS failed (-110)".<br /> <br /> Setting the timeout back to 5 seconds fixes both cases.

Vulnerable products and versions

CPE From Up to
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.16 (including) 6.1.22 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.2 (including) 6.2.9 (excluding)
cpe:2.3:o:linux:linux_kernel:6.3:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.3:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.3:rc3:*:*:*:*:*:*