GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2023-53090 (GCVE-0-2023-53090)

Vulnerability from cvelistv5 – Published: 2025-05-02 15:55 – Updated: 2026-08-05 09:12
VLAI
Title
drm/amdkfd: Fix an illegal memory access
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix an illegal memory access In the kfd_wait_on_events() function, the kfd_event_waiter structure is allocated by alloc_event_waiters(), but the event field of the waiter structure is not initialized; When copy_from_user() fails in the kfd_wait_on_events() function, it will enter exception handling to release the previously allocated memory of the waiter structure; Due to the event field of the waiters structure being accessed in the free_waiters() function, this results in illegal memory access and system crash, here is the crash log: localhost kernel: RIP: 0010:native_queued_spin_lock_slowpath+0x185/0x1e0 localhost kernel: RSP: 0018:ffffaa53c362bd60 EFLAGS: 00010082 localhost kernel: RAX: ff3d3d6bff4007cb RBX: 0000000000000282 RCX: 00000000002c0000 localhost kernel: RDX: ffff9e855eeacb80 RSI: 000000000000279c RDI: ffffe7088f6a21d0 localhost kernel: RBP: ffffe7088f6a21d0 R08: 00000000002c0000 R09: ffffaa53c362be64 localhost kernel: R10: ffffaa53c362bbd8 R11: 0000000000000001 R12: 0000000000000002 localhost kernel: R13: ffff9e7ead15d600 R14: 0000000000000000 R15: ffff9e7ead15d698 localhost kernel: FS: 0000152a3d111700(0000) GS:ffff9e855ee80000(0000) knlGS:0000000000000000 localhost kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 localhost kernel: CR2: 0000152938000010 CR3: 000000044d7a4000 CR4: 00000000003506e0 localhost kernel: Call Trace: localhost kernel: _raw_spin_lock_irqsave+0x30/0x40 localhost kernel: remove_wait_queue+0x12/0x50 localhost kernel: kfd_wait_on_events+0x1b6/0x490 [hydcu] localhost kernel: ? ftrace_graph_caller+0xa0/0xa0 localhost kernel: kfd_ioctl+0x38c/0x4a0 [hydcu] localhost kernel: ? kfd_ioctl_set_trap_handler+0x70/0x70 [hydcu] localhost kernel: ? kfd_ioctl_create_queue+0x5a0/0x5a0 [hydcu] localhost kernel: ? ftrace_graph_caller+0xa0/0xa0 localhost kernel: __x64_sys_ioctl+0x8e/0xd0 localhost kernel: ? syscall_trace_enter.isra.18+0x143/0x1b0 localhost kernel: do_syscall_64+0x33/0x80 localhost kernel: entry_SYSCALL_64_after_hwframe+0x44/0xa9 localhost kernel: RIP: 0033:0x152a4dff68d7 Allocate the structure with kcalloc, and remove redundant 0-initialization and a redundant loop condition check.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 4a488a7ad71401169cecee75dc94bcce642e2c53 , < 5a3fb3b745af0ce46ec2e0c8e507bae45b937334 (git)
Affected: 4a488a7ad71401169cecee75dc94bcce642e2c53 , < bbf5eada4334a96e3a204b2307ff5b14dc380b0b (git)
Affected: 4a488a7ad71401169cecee75dc94bcce642e2c53 , < 6936525142a015e854d0a23e9ad9ea0a28b3843d (git)
Affected: 4a488a7ad71401169cecee75dc94bcce642e2c53 , < 2fece63b55c5d74cd6f5de51159e2cde37e10555 (git)
Affected: 4a488a7ad71401169cecee75dc94bcce642e2c53 , < d9923e7214a870b312bf61f6a89c7554d0966985 (git)
Affected: 4a488a7ad71401169cecee75dc94bcce642e2c53 , < 61f306f8df0d5559659c5578cf6d95236bcdcb25 (git)
Affected: 4a488a7ad71401169cecee75dc94bcce642e2c53 , < 4fc8fff378b2f2039f2a666d9f8c570f4e58352c (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.19
Unaffected: 0 , < 3.19 (semver)
Unaffected: 4.19.279 , ≤ 4.19.* (semver)
Unaffected: 5.4.238 , ≤ 5.4.* (semver)
Unaffected: 5.10.176 , ≤ 5.10.* (semver)
Unaffected: 5.15.104 , ≤ 5.15.* (semver)
Unaffected: 6.1.21 , ≤ 6.1.* (semver)
Unaffected: 6.2.8 , ≤ 6.2.* (semver)
Unaffected: 6.3 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdkfd/kfd_events.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5a3fb3b745af0ce46ec2e0c8e507bae45b937334",
              "status": "affected",
              "version": "4a488a7ad71401169cecee75dc94bcce642e2c53",
              "versionType": "git"
            },
            {
              "lessThan": "bbf5eada4334a96e3a204b2307ff5b14dc380b0b",
              "status": "affected",
              "version": "4a488a7ad71401169cecee75dc94bcce642e2c53",
              "versionType": "git"
            },
            {
              "lessThan": "6936525142a015e854d0a23e9ad9ea0a28b3843d",
              "status": "affected",
              "version": "4a488a7ad71401169cecee75dc94bcce642e2c53",
              "versionType": "git"
            },
            {
              "lessThan": "2fece63b55c5d74cd6f5de51159e2cde37e10555",
              "status": "affected",
              "version": "4a488a7ad71401169cecee75dc94bcce642e2c53",
              "versionType": "git"
            },
            {
              "lessThan": "d9923e7214a870b312bf61f6a89c7554d0966985",
              "status": "affected",
              "version": "4a488a7ad71401169cecee75dc94bcce642e2c53",
              "versionType": "git"
            },
            {
              "lessThan": "61f306f8df0d5559659c5578cf6d95236bcdcb25",
              "status": "affected",
              "version": "4a488a7ad71401169cecee75dc94bcce642e2c53",
              "versionType": "git"
            },
            {
              "lessThan": "4fc8fff378b2f2039f2a666d9f8c570f4e58352c",
              "status": "affected",
              "version": "4a488a7ad71401169cecee75dc94bcce642e2c53",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdkfd/kfd_events.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.19"
            },
            {
              "lessThan": "3.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.279",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.238",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.21",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.2.*",
              "status": "unaffected",
              "version": "6.2.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.279",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.238",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.176",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.104",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.21",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2.8",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Fix an illegal memory access\n\nIn the kfd_wait_on_events() function, the kfd_event_waiter structure is\nallocated by alloc_event_waiters(), but the event field of the waiter\nstructure is not initialized; When copy_from_user() fails in the\nkfd_wait_on_events() function, it will enter exception handling to\nrelease the previously allocated memory of the waiter structure;\nDue to the event field of the waiters structure being accessed\nin the free_waiters() function, this results in illegal memory access\nand system crash, here is the crash log:\n\nlocalhost kernel: RIP: 0010:native_queued_spin_lock_slowpath+0x185/0x1e0\nlocalhost kernel: RSP: 0018:ffffaa53c362bd60 EFLAGS: 00010082\nlocalhost kernel: RAX: ff3d3d6bff4007cb RBX: 0000000000000282 RCX: 00000000002c0000\nlocalhost kernel: RDX: ffff9e855eeacb80 RSI: 000000000000279c RDI: ffffe7088f6a21d0\nlocalhost kernel: RBP: ffffe7088f6a21d0 R08: 00000000002c0000 R09: ffffaa53c362be64\nlocalhost kernel: R10: ffffaa53c362bbd8 R11: 0000000000000001 R12: 0000000000000002\nlocalhost kernel: R13: ffff9e7ead15d600 R14: 0000000000000000 R15: ffff9e7ead15d698\nlocalhost kernel: FS:  0000152a3d111700(0000) GS:ffff9e855ee80000(0000) knlGS:0000000000000000\nlocalhost kernel: CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nlocalhost kernel: CR2: 0000152938000010 CR3: 000000044d7a4000 CR4: 00000000003506e0\nlocalhost kernel: Call Trace:\nlocalhost kernel: _raw_spin_lock_irqsave+0x30/0x40\nlocalhost kernel: remove_wait_queue+0x12/0x50\nlocalhost kernel: kfd_wait_on_events+0x1b6/0x490 [hydcu]\nlocalhost kernel: ? ftrace_graph_caller+0xa0/0xa0\nlocalhost kernel: kfd_ioctl+0x38c/0x4a0 [hydcu]\nlocalhost kernel: ? kfd_ioctl_set_trap_handler+0x70/0x70 [hydcu]\nlocalhost kernel: ? kfd_ioctl_create_queue+0x5a0/0x5a0 [hydcu]\nlocalhost kernel: ? ftrace_graph_caller+0xa0/0xa0\nlocalhost kernel: __x64_sys_ioctl+0x8e/0xd0\nlocalhost kernel: ? syscall_trace_enter.isra.18+0x143/0x1b0\nlocalhost kernel: do_syscall_64+0x33/0x80\nlocalhost kernel: entry_SYSCALL_64_after_hwframe+0x44/0xa9\nlocalhost kernel: RIP: 0033:0x152a4dff68d7\n\nAllocate the structure with kcalloc, and remove redundant 0-initialization\nand a redundant loop condition check."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Triggered via the local AMDKFD_IOC_WAIT_EVENTS ioctl on /dev/kfd (kfd_ioctl \u2192 kfd_ioctl_wait_events \u2192 kfd_wait_on_events), not via network or adjacent protocols.\nAC:L - An attacker reliably triggers the path by opening /dev/kfd and issuing WAIT_EVENTS with a bad events_ptr so copy_from_user fails; heap spray to shape the uninitialized event pointer is fully under attacker control.\nPR:L - /dev/kfd is mode 0660 root:render with seat uaccess; WAIT_EVENTS has no capability check, so any unprivileged local user with normal GPU/render access can reach it.\nUI:N - The attacker opens /dev/kfd and issues the ioctl themselves; no separate victim action is required.\nS:U - Impact is confined to host-kernel memory corruption/DoS within the same OS security authority; no VM escape, IOMMU bypass, or other cross-boundary effect.\nC:H - Uninitialized kmalloc heap contents are treated as a kfd_event pointer; with slab spray the dangling use enables reading/reusing attacker-reclaimed object state as part of further kernel memory disclosure.\nI:H - free_waiters() performs spin_lock/unlock and wait-queue operations through the attacker-influenced wild event pointer, yielding kernel memory writes exploitable for corruption and control-flow hijack.\nA:H - The documented outcome is a kernel oops in native_queued_spin_lock_slowpath via remove_wait_queue, which is a full system availability loss."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:12:44.522Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5a3fb3b745af0ce46ec2e0c8e507bae45b937334"
        },
        {
          "url": "https://git.kernel.org/stable/c/bbf5eada4334a96e3a204b2307ff5b14dc380b0b"
        },
        {
          "url": "https://git.kernel.org/stable/c/6936525142a015e854d0a23e9ad9ea0a28b3843d"
        },
        {
          "url": "https://git.kernel.org/stable/c/2fece63b55c5d74cd6f5de51159e2cde37e10555"
        },
        {
          "url": "https://git.kernel.org/stable/c/d9923e7214a870b312bf61f6a89c7554d0966985"
        },
        {
          "url": "https://git.kernel.org/stable/c/61f306f8df0d5559659c5578cf6d95236bcdcb25"
        },
        {
          "url": "https://git.kernel.org/stable/c/4fc8fff378b2f2039f2a666d9f8c570f4e58352c"
        }
      ],
      "title": "drm/amdkfd: Fix an illegal memory access",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53090",
    "datePublished": "2025-05-02T15:55:36.164Z",
    "dateReserved": "2025-05-02T15:51:43.551Z",
    "dateUpdated": "2026-08-05T09:12:44.522Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-53090",
      "date": "2026-09-17",
      "epss": "0.00204",
      "percentile": "0.10704"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-53090\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-05-02T16:15:27.957\",\"lastModified\":\"2026-08-04T10:18:54.770\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/amdkfd: Fix an illegal memory access\\n\\nIn the kfd_wait_on_events() function, the kfd_event_waiter structure is\\nallocated by alloc_event_waiters(), but the event field of the waiter\\nstructure is not initialized; When copy_from_user() fails in the\\nkfd_wait_on_events() function, it will enter exception handling to\\nrelease the previously allocated memory of the waiter structure;\\nDue to the event field of the waiters structure being accessed\\nin the free_waiters() function, this results in illegal memory access\\nand system crash, here is the crash log:\\n\\nlocalhost kernel: RIP: 0010:native_queued_spin_lock_slowpath+0x185/0x1e0\\nlocalhost kernel: RSP: 0018:ffffaa53c362bd60 EFLAGS: 00010082\\nlocalhost kernel: RAX: ff3d3d6bff4007cb RBX: 0000000000000282 RCX: 00000000002c0000\\nlocalhost kernel: RDX: ffff9e855eeacb80 RSI: 000000000000279c RDI: ffffe7088f6a21d0\\nlocalhost kernel: RBP: ffffe7088f6a21d0 R08: 00000000002c0000 R09: ffffaa53c362be64\\nlocalhost kernel: R10: ffffaa53c362bbd8 R11: 0000000000000001 R12: 0000000000000002\\nlocalhost kernel: R13: ffff9e7ead15d600 R14: 0000000000000000 R15: ffff9e7ead15d698\\nlocalhost kernel: FS:  0000152a3d111700(0000) GS:ffff9e855ee80000(0000) knlGS:0000000000000000\\nlocalhost kernel: CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\nlocalhost kernel: CR2: 0000152938000010 CR3: 000000044d7a4000 CR4: 00000000003506e0\\nlocalhost kernel: Call Trace:\\nlocalhost kernel: _raw_spin_lock_irqsave+0x30/0x40\\nlocalhost kernel: remove_wait_queue+0x12/0x50\\nlocalhost kernel: kfd_wait_on_events+0x1b6/0x490 [hydcu]\\nlocalhost kernel: ? ftrace_graph_caller+0xa0/0xa0\\nlocalhost kernel: kfd_ioctl+0x38c/0x4a0 [hydcu]\\nlocalhost kernel: ? kfd_ioctl_set_trap_handler+0x70/0x70 [hydcu]\\nlocalhost kernel: ? kfd_ioctl_create_queue+0x5a0/0x5a0 [hydcu]\\nlocalhost kernel: ? ftrace_graph_caller+0xa0/0xa0\\nlocalhost kernel: __x64_sys_ioctl+0x8e/0xd0\\nlocalhost kernel: ? syscall_trace_enter.isra.18+0x143/0x1b0\\nlocalhost kernel: do_syscall_64+0x33/0x80\\nlocalhost kernel: entry_SYSCALL_64_after_hwframe+0x44/0xa9\\nlocalhost kernel: RIP: 0033:0x152a4dff68d7\\n\\nAllocate the structure with kcalloc, and remove redundant 0-initialization\\nand a redundant loop condition check.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/amdkfd: Se corrige un acceso ilegal a memoria En la funci\u00f3n kfd_wait_on_events(), la estructura kfd_event_waiter es asignada por alloc_event_waiters(), pero el campo de evento de la estructura waiter no se inicializa; Cuando copy_from_user() falla en la funci\u00f3n kfd_wait_on_events(), ingresar\u00e1 al control de excepciones para liberar la memoria previamente asignada de la estructura waiter; Debido a que se accede al campo de evento de la estructura waiters en la funci\u00f3n free_waiters(), esto da como resultado un acceso ilegal a la memoria y un bloqueo del sistema. Aqu\u00ed est\u00e1 el registro de bloqueo: kernel localhost: RIP: 0010:native_queued_spin_lock_slowpath+0x185/0x1e0 kernel localhost: RSP: 0018:ffffaa53c362bd60 EFLAGS: 00010082 kernel localhost: RAX: ff3d3d6bff4007cb RBX: 0000000000000282 RCX: 00000000002c0000 kernel localhost: RDX: ffff9e855eeacb80 RSI: 000000000000279c RDI: ffffe7088f6a21d0 kernel localhost: RBP: ffffe7088f6a21d0 R08: 00000000002c0000 R09: ffffaa53c362be64 n\u00facleo del host local: R10: ffffaa53c362bbd8 R11: 0000000000000001 R12: 0000000000000002 n\u00facleo del host local: R13: ffff9e7ead15d600 R14: 0000000000000000 R15: ffff9e7ead15d698 n\u00facleo del host local: FS: 0000152a3d111700(0000) GS:ffff9e855ee80000(0000) knlGS:0000000000000000 n\u00facleo localhost: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 n\u00facleo localhost: CR2: 0000152938000010 CR3: 000000044d7a4000 CR4: 00000000003506e0 n\u00facleo localhost: Seguimiento de llamadas: n\u00facleo localhost: _raw_spin_lock_irqsave+0x30/0x40 n\u00facleo localhost: remove_wait_queue+0x12/0x50 n\u00facleo localhost: kfd_wait_on_events+0x1b6/0x490 [hydcu] n\u00facleo localhost: ? ftrace_graph_caller+0xa0/0xa0 n\u00facleo local del host: kfd_ioctl+0x38c/0x4a0 [hydcu] n\u00facleo local del host: ? kfd_ioctl_set_trap_handler+0x70/0x70 [hydcu] n\u00facleo local del host: ? kfd_ioctl_create_queue+0x5a0/0x5a0 [hydcu] n\u00facleo local del host: ? ftrace_graph_caller+0xa0/0xa0 n\u00facleo local del host: __x64_sys_ioctl+0x8e/0xd0 n\u00facleo local del host: ? syscall_trace_enter.isra.18+0x143/0x1b0 kernel localhost: do_syscall_64+0x33/0x80 kernel localhost: entry_SYSCALL_64_after_hwframe+0x44/0xa9 kernel localhost: RIP: 0033:0x152a4dff68d7 Asigne la estructura con kcalloc y elimine la inicializaci\u00f3n 0 redundante y una verificaci\u00f3n de condici\u00f3n de bucle redundante.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/amd/amdkfd/kfd_events.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4a488a7ad71401169cecee75dc94bcce642e2c53\",\"lessThan\":\"5a3fb3b745af0ce46ec2e0c8e507bae45b937334\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4a488a7ad71401169cecee75dc94bcce642e2c53\",\"lessThan\":\"bbf5eada4334a96e3a204b2307ff5b14dc380b0b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4a488a7ad71401169cecee75dc94bcce642e2c53\",\"lessThan\":\"6936525142a015e854d0a23e9ad9ea0a28b3843d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4a488a7ad71401169cecee75dc94bcce642e2c53\",\"lessThan\":\"2fece63b55c5d74cd6f5de51159e2cde37e10555\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4a488a7ad71401169cecee75dc94bcce642e2c53\",\"lessThan\":\"d9923e7214a870b312bf61f6a89c7554d0966985\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4a488a7ad71401169cecee75dc94bcce642e2c53\",\"lessThan\":\"61f306f8df0d5559659c5578cf6d95236bcdcb25\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4a488a7ad71401169cecee75dc94bcce642e2c53\",\"lessThan\":\"4fc8fff378b2f2039f2a666d9f8c570f4e58352c\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/amd/amdkfd/kfd_events.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.19\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.19\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.279\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.238\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.176\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.104\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.21\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.2.8\",\"lessThanOrEqual\":\"6.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.3\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.19\",\"versionEndExcluding\":\"4.19.279\",\"matchCriteriaId\":\"E846B67C-E431-434B-B719-6B93BC9B2E96\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.238\",\"matchCriteriaId\":\"5FF05A65-6B32-4A9C-905D-6E0F17C6803B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.176\",\"matchCriteriaId\":\"7DA7FEF3-FE10-4D78-94E4-BDCDA7371DD5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.104\",\"matchCriteriaId\":\"EB8A3D70-3EE1-4B1C-8A21-21CA7356DCA7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.21\",\"matchCriteriaId\":\"1F1CA6A9-8F4D-408D-9116-868EC067DCD9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.2.8\",\"matchCriteriaId\":\"4011EC6B-7786-4709-B765-186FA31D6F7F\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2fece63b55c5d74cd6f5de51159e2cde37e10555\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4fc8fff378b2f2039f2a666d9f8c570f4e58352c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5a3fb3b745af0ce46ec2e0c8e507bae45b937334\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/61f306f8df0d5559659c5578cf6d95236bcdcb25\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6936525142a015e854d0a23e9ad9ea0a28b3843d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/bbf5eada4334a96e3a204b2307ff5b14dc380b0b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d9923e7214a870b312bf61f6a89c7554d0966985\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:21:48+00:00",
      "cve": "CVE-2023-53090",
      "id": "CVE-2023-53090",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:fixed": "120",
      "product_status:known_affected": "124",
      "product_status:known_not_affected": "118",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/amdkfd: Fix an illegal memory access",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-53090.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.