CVE-2023-53991

drm/msm/dpu: Disallow unallocated resources to be returned

N/A
Published: December 24, 2025 at 10:55 AM UTC
Updated: June 17, 2026 at 06:46 AM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
N/A
Exploit prediction
EPSS 0.2%

Description

In the Linux kernel, the following vulnerability has been resolved: drm/msm/dpu: Disallow unallocated resources to be returned In the event that the topology requests resources that have not been created by the system (because they are typically not represented in dpu_mdss_cfg ^1), the resource(s) in global_state (in this case DSC blocks, until their allocation/assignment is being sanity-checked in "drm/msm/dpu: Reject topologies for which no DSC blocks are available") remain NULL but will still be returned out of dpu_rm_get_assigned_resources, where the caller expects to get an array containing num_blks valid pointers (but instead gets these NULLs). To prevent this from happening, where null-pointer dereferences typically result in a hard-to-debug platform lockup, num_blks shouldn't increase past NULL blocks and will print an error and break instead. After all, max_blks represents the static size of the maximum number of blocks whereas the actual amount varies per platform. ^1: which can happen after a git rebase ended up moving additions to _dpu_cfg to a different struct which has the same patch context. Patchwork: https://patchwork.freedesktop.org/patch/517636/

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

5.7 ≤ v < 5.10.1735.7 ≤ v < 5.15.995.7 ≤ v < 6.1.165.7 ≤ v < 6.2.35.7 ≤ v < 6.35.7bb00a452d6f77391441ef7df48f7115dd459cd2f
Vendor states this is fixed in 8dbd54d679e3ab37be43bc1ed9f463dbf83a2259 (fixed)
Vendor states this is fixed in 9e1e236acdc42b5c43ec8d7f03a39537e70cc309 (fixed)
Vendor states this is fixed in 9fe3644c720ac87d150f0bba5a4ae86cae55afaf (fixed)
Vendor states this is fixed in abc40122d9a69f56c04efb5a7485795f5ac799d1 (fixed)
Vendor states this is fixed in bf661c5e3bc48973acb363c76e3db965d9ed26d0 (fixed)
Vendor states this is fixed in 5.10.173 (unaffected)
Vendor states this is fixed in 5.15.99 (unaffected)
Vendor states this is fixed in 5.7 (unaffected)
Vendor states this is fixed in 6.1.16 (unaffected)
Vendor states this is fixed in 6.2.3 (unaffected)
Vendor states this is fixed in 6.3 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

Quick Info

StatusDEFERRED

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card