GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2023-53806 (GCVE-0-2023-53806)

Vulnerability from cvelistv5 – Published: 2025-12-09 00:01 – Updated: 2026-08-05 09:16
VLAI
Title
drm/amd/display: populate subvp cmd info only for the top pipe
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: populate subvp cmd info only for the top pipe [Why] System restart observed while changing the display resolution to 8k with extended mode. Sytem restart was caused by a page fault. [How] When the driver populates subvp info it did it for both the pipes using vblank which caused an outof bounds array access causing the page fault. added checks to allow the top pipe only to fix this issue.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c , < 92e6c79acad4b96efeff261d27bdbd8089a7dd24 (git)
Affected: 4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c , < 375d192eb1f1d9229a6d994da7ba31f3582b106b (git)
Affected: 4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c , < 9bb10b7aaec3b6278f9cc410c17dcaa129bbbbf0 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.15
Unaffected: 0 , < 4.15 (semver)
Unaffected: 6.1.30 , ≤ 6.1.* (semver)
Unaffected: 6.3.4 , ≤ 6.3.* (semver)
Unaffected: 6.4 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "92e6c79acad4b96efeff261d27bdbd8089a7dd24",
              "status": "affected",
              "version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c",
              "versionType": "git"
            },
            {
              "lessThan": "375d192eb1f1d9229a6d994da7ba31f3582b106b",
              "status": "affected",
              "version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c",
              "versionType": "git"
            },
            {
              "lessThan": "9bb10b7aaec3b6278f9cc410c17dcaa129bbbbf0",
              "status": "affected",
              "version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.15"
            },
            {
              "lessThan": "4.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.30",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.3.*",
              "status": "unaffected",
              "version": "6.3.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.4",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.30",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3.4",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: populate subvp cmd info only for the top pipe\n\n[Why]\nSystem restart observed while changing the display resolution\nto 8k with extended mode. Sytem restart was caused by a page fault.\n\n[How]\nWhen the driver populates subvp info it did it for both the pipes using\nvblank which caused an outof bounds array access causing the page fault.\nadded checks to allow the top pipe only to fix this issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached only through DRM modeset ioctls (`DRM_IOCTL_MODE_ATOMIC`/`SETCRTC`) on the local `/dev/dri/card0` device node, driving amdgpu\u0027s atomic commit into `dcn32_commit_subvp_config()`. There is no network or remote input involved.\nAC:L - A local attacker holding DRM master can repeatedly issue atomic commits with high-resolution/multi-display configurations that force ODM/MPC pipe splits alongside a SubVP stream, deterministically pushing `cmd_pipe_index` past 1. No race or unpredictable memory-layout condition is involved \u2014 the overflow is a fixed-offset write that happens every time the pipe topology is hit.\nPR:L - Only an unprivileged local user with access to the DRM primary node is needed \u2014 the logged-in console/session user is granted this via logind ACLs (or `video` group membership), and DRM master is obtainable without root. No capability check exists anywhere on the path from the ioctl to `dc_dmub_setup_subvp_dmub_command()`.\nUI:N - The attacker performs the modeset themselves via ioctl; no action by another user or victim is required to reach the overflowing loop.\nS:U - The out-of-bounds write corrupts the kernel\u0027s own stack within the same security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - Up to 56 bytes of kernel stack beyond the 64-byte `union dmub_rb_cmd` local are overwritten with mode-derived values, corrupting saved registers, pointers, and the return-address region of the caller\u0027s frame. Such stack corruption is leverageable to redirect subsequent kernel operations and disclose arbitrary kernel memory.\nI:H - This is an out-of-bounds stack write with partially attacker-influenced content (display timings supplied through the requested modeline), which per kernel scoring practice constitutes a high integrity impact \u2014 it can smash the stack canary and return address, giving a path to control-flow hijacking and arbitrary modification of kernel state.\nA:H - The bug was reported as causing a page fault and full system restart when changing to 8K in extended mode; stack smashing reliably produces an oops, stack-protector panic, or hard hang, taking down the machine."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:16:08.328Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/92e6c79acad4b96efeff261d27bdbd8089a7dd24"
        },
        {
          "url": "https://git.kernel.org/stable/c/375d192eb1f1d9229a6d994da7ba31f3582b106b"
        },
        {
          "url": "https://git.kernel.org/stable/c/9bb10b7aaec3b6278f9cc410c17dcaa129bbbbf0"
        }
      ],
      "title": "drm/amd/display: populate subvp cmd info only for the top pipe",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53806",
    "datePublished": "2025-12-09T00:01:04.413Z",
    "dateReserved": "2025-12-08T23:58:35.276Z",
    "dateUpdated": "2026-08-05T09:16:08.328Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-53806",
      "date": "2026-09-14",
      "epss": "0.00141",
      "percentile": "0.0375"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-53806\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-09T01:16:52.540\",\"lastModified\":\"2026-08-04T10:19:22.217\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/amd/display: populate subvp cmd info only for the top pipe\\n\\n[Why]\\nSystem restart observed while changing the display resolution\\nto 8k with extended mode. Sytem restart was caused by a page fault.\\n\\n[How]\\nWhen the driver populates subvp info it did it for both the pipes using\\nvblank which caused an outof bounds array access causing the page fault.\\nadded checks to allow the top pipe only to fix this issue.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c\",\"lessThan\":\"92e6c79acad4b96efeff261d27bdbd8089a7dd24\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c\",\"lessThan\":\"375d192eb1f1d9229a6d994da7ba31f3582b106b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c\",\"lessThan\":\"9bb10b7aaec3b6278f9cc410c17dcaa129bbbbf0\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.30\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.3.4\",\"lessThanOrEqual\":\"6.3.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.4\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/375d192eb1f1d9229a6d994da7ba31f3582b106b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/92e6c79acad4b96efeff261d27bdbd8089a7dd24\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9bb10b7aaec3b6278f9cc410c17dcaa129bbbbf0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:15:32+00:00",
      "cve": "CVE-2023-53806",
      "id": "CVE-2023-53806",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:fixed": "279",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "166",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/amd/display: populate subvp cmd info only for the top pipe",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-53806.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.