CVE-2023-53833 drm/i915: Fix NULL ptr deref by checking new_crtc_state
A NULL pointer dereference in the Linux kernel's i915 driver allows local attackers to cause a system crash.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-53833?
CVE-2023-53833 is a vulnerability in Linux, published on 9 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
drm/i915: Fix NULL ptr deref by checking new_crtc_state
intel_atomic_get_new_crtc_state can return NULL, unless crtc state wasn't obtained previously with intel_atomic_get_crtc_state, so we must check it for NULLness here, just as in many other places, where we can't guarantee that intel_atomic_get_crtc_state was called. We are currently getting NULL ptr deref because of that, so this fix was confirmed to help.
(cherry picked from commit 1d5b09f8daf859247a1ea65b0d732a24d88980d8)
Which versions are affected by CVE-2023-53833?
How do I fix CVE-2023-53833?
Apply the vendor's patch.
Is CVE-2023-53833 being exploited?
There is no known exploitation of CVE-2023-53833 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2023-53833, DEBIAN-CVE-2023-53833, GHSA-x2p5-wm9v-xvm5, UBUNTU-CVE-2023-53833.