{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2023-53628 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2023-53628 is a medium-severity vulnerability in Linux kernel, published on 7 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2023-53628 and fix it if it is affected.\n\nWhat it is: CVE-2023-53628 is a medium-severity vulnerability in Linux kernel, published on 7 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2023-53628 in the wild and no public exploit code.\n\nAffected product: Linux kernel. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2023-53628/ (Markdown: https://insights.sbomify.com/CVE-2023-53628/index.md)","id":"CVE-2023-53628","markdown":"https://insights.sbomify.com/CVE-2023-53628/index.md","name":"CVE-2023-53628","record":{"aliases":["BELL-CVE-2023-53628","DEBIAN-CVE-2023-53628","GHSA-4mh8-7crp-48x9","ROOT-OS-DEBIAN-11-CVE-2023-53628","ROOT-OS-UBUNTU-2204-CVE-2023-53628","UBUNTU-CVE-2023-53628"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel driver","requires_auth":"low_privilege","summary":"A null pointer dereference in the AMD GPU driver causes a kernel crash during hardware finalization, leading to denial of service.","user_interaction":"not_required","vuln_class":"null_dereference"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[{"product":"linux_kernel","vendor":"linux"}],"cvss":{"score":5.5,"severity":"medium","source":"nvd","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: drop gfx_v11_0_cp_ecc_error_irq_funcs\n\nThe gfx.cp_ecc_error_irq is retired in gfx11. In gfx_v11_0_hw_fini still\nuse amdgpu_irq_put to disable this interrupt, which caused the call trace\nin this function.\n\n[  102.873958] Call Trace:\n[  102.873959]  \u003cTASK\u003e\n[  102.873961]  gfx_v11_0_hw_fini+0x23/0x1e0 [amdgpu]\n[  102.874019]  gfx_v11_0_suspend+0xe/0x20 [amdgpu]\n[  102.874072]  amdgpu_device_ip_suspend_phase2+0x240/0x460 [amdgpu]\n[  102.874122]  amdgpu_device_ip_suspend+0x3d/0x80 [amdgpu]\n[  102.874172]  amdgpu_device_pre_asic_reset+0xd9/0x490 [amdgpu]\n[  102.874223]  amdgpu_device_gpu_recover.cold+0x548/0xce6 [amdgpu]\n[  102.874321]  amdgpu_debugfs_reset_work+0x4c/0x70 [amdgpu]\n[  102.874375]  process_one_work+0x21f/0x3f0\n[  102.874377]  worker_thread+0x200/0x3e0\n[  102.874378]  ? process_one_work+0x3f0/0x3f0\n[  102.874379]  kthread+0xfd/0x130\n[  102.874380]  ? kthread_complete_and_exit+0x20/0x20\n[  102.874381]  ret_from_fork+0x22/0x30\n\nv2:\n- Handle umc and gfx ras cases in separated patch\n- Retired the gfx_v11_0_cp_ecc_error_irq_funcs in gfx11\n\nv3:\n- Improve the subject and code comments\n- Add judgment on gfx11 in the function of amdgpu_gfx_ras_late_init\n\nv4:\n- Drop the define of CP_ME1_PIPE_INST_ADDR_INTERVAL and\nSET_ECC_ME_PIPE_STATE which using in gfx_v11_0_set_cp_ecc_error_state\n- Check cp_ecc_error_irq.funcs rather than ip version for a more\nsustainable life\n\nv5:\n- Simplify judgment conditions","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"drm/amdgpu: drop gfx_v11_0_cp_ecc_error_irq_funcs","id":"CVE-2023-53628","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"linux:linux_kernel","products":["linux:linux_kernel"],"type":"null_dereference","year":"2023"},"n_packages":0,"n_references":2,"next":{"headline":"fs: dlm: fix use after free in midcomms commit","id":"CVE-2023-53629"},"packages":[],"prev":{"headline":"scsi: hisi_sas: Grab sas_dev lock when traversing the members of sas_dev.list","id":"CVE-2023-53627"},"products":["Linux"],"published":"2025-10-07","related":[{"cvss_score":8.8,"headline":"Linux Kernel Out-of-Bounds Write","id":"CVE-2026-53266","kev_date_added":"2026-09-18","published":"2026-06-25"},{"cvss_score":8.8,"headline":"Linux Kernel Improper Input Validation","id":"CVE-2013-6282","kev_date_added":"2022-09-15","published":"2013-11-19"},{"cvss_score":8.4,"headline":"Linux Kernel Heap-Based Buffer Overflow","id":"CVE-2022-0185","kev_date_added":"2024-08-21","published":"2022-02-11"},{"cvss_score":8.4,"headline":"Linux Kernel Privilege Escalation","id":"CVE-2013-2094","kev_date_added":"2022-09-15","published":"2013-05-14"},{"cvss_score":7.8,"headline":"Linux Kernel Unspecified","id":"CVE-2026-53362","kev_date_added":"2026-08-27","published":"2026-07-04"},{"cvss_score":7.8,"headline":"Linux Kernel Missing Initialization of a Variable","id":"CVE-2026-46300","kev_date_added":"2026-10-28","published":"2026-05-23"},{"cvss_score":7.8,"headline":"Linux Kernel Race Condition","id":"CVE-2025-39964","kev_date_added":"2026-09-18","published":"2025-10-13"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-05-11","vendors":["Linux"]},"summary":"A null pointer dereference in the AMD GPU driver causes a kernel crash during hardware finalization, leading to denial of service.","url":"https://insights.sbomify.com/CVE-2023-53628/"}