CVE-2023-53991 drm/msm/dpu: Disallow unallocated resources to be returned
A null pointer dereference in the Linux kernel DPU driver allows local attackers to cause a system lockup or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-53991?
CVE-2023-53991 is a vulnerability in Linux, published on 24 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
drm/msm/dpu: Disallow unallocated resources to be returned
In the event that the topology requests resources that have not been created by the system (because they are typically not represented in dpu_mdss_cfg ^1), the resource(s) in global_state (in this case DSC blocks, until their allocation/assignment is being sanity-checked in "drm/msm/dpu: Reject topologies for which no DSC blocks are available") remain NULL but will still be returned out of dpu_rm_get_assigned_resources, where the caller expects to get an array containing num_blks valid pointers (but instead gets these NULLs).
To prevent this from happening, where null-pointer dereferences typically result in a hard-to-debug platform lockup, num_blks shouldn't increase past NULL blocks and will print an error and break instead. After all, max_blks represents the static size of the maximum number of blocks whereas the actual amount varies per platform.
^1: which can happen after a git rebase ended up moving additions to _dpu_cfg to a different struct which has the same patch context.
Patchwork: https://patchwork.freedesktop.org/patch/517636/
Which versions are affected by CVE-2023-53991?
How do I fix CVE-2023-53991?
Apply the vendor's patch.
Is CVE-2023-53991 being exploited?
There is no known exploitation of CVE-2023-53991 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2023-53991, DEBIAN-CVE-2023-53991, GHSA-8m95-4p4w-6hv6, UBUNTU-CVE-2023-53991.