{"id":"CVE-2023-1079","details":"A flaw was found in the Linux kernel. A use-after-free may be triggered in asus_kbd_backlight_set when plugging/disconnecting in a malicious USB device, which advertises itself as an Asus device. Similarly to the previous known CVE-2023-25012, but in asus devices, the work_struct may be scheduled by the LED controller while the device is disconnecting, triggering a use-after-free on the struct asus_kbd_leds *led structure. A malicious USB device may exploit the issue to cause memory corruption with controlled data.","modified":"2026-03-13T06:50:29.127685Z","published":"2023-03-27T21:15:10.573Z","related":["ALSA-2023:7077","MGASA-2023-0148","MGASA-2023-0149","SUSE-SU-2023:2500-1","SUSE-SU-2023:2502-1","SUSE-SU-2023:2611-1","SUSE-SU-2023:2646-1","SUSE-SU-2023:2651-1","SUSE-SU-2023:2653-1","SUSE-SU-2023:2782-1","SUSE-SU-2023:2804-1","SUSE-SU-2023:2808-1","SUSE-SU-2023:2809-1","SUSE-SU-2023:2822-1","SUSE-SU-2023:2830-1","SUSE-SU-2023:2871-1"],"references":[{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html"},{"type":"FIX","url":"https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=4ab3a086d10eeec1424f2e8a968827a6336203df"}],"affected":[{"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-1079.json","unresolved_ranges":[{"events":[{"introduced":"0"},{"fixed":"6.3"}]}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}