GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2023-53378 (GCVE-0-2023-53378)

Vulnerability from cvelistv5 – Published: 2025-09-18 13:33 – Updated: 2026-08-05 09:13
VLAI
Title
drm/i915/dpt: Treat the DPT BO as a framebuffer
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/i915/dpt: Treat the DPT BO as a framebuffer Currently i915_gem_object_is_framebuffer() doesn't treat the BO containing the framebuffer's DPT as a framebuffer itself. This means eg. that the shrinker can evict the DPT BO while leaving the actual FB BO bound, when the DPT is allocated from regular shmem. That causes an immediate oops during hibernate as we try to rewrite the PTEs inside the already evicted DPT obj. TODO: presumably this might also be the reason for the DPT related display faults under heavy memory pressure, but I'm still not sure how that would happen as the object should be pinned by intel_dpt_pin() while in active use by the display engine... (cherry picked from commit 779cb5ba64ec7df80675a956c9022929514f517a)
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-14 18:55 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 0dc987b699ce4266450d407d6d79d41eab88c5d0 , < c781c107731fc09ce4330c8c636b8446d0f72aa4 (git)
Affected: 0dc987b699ce4266450d407d6d79d41eab88c5d0 , < 5390a02b4508416b9bee96674f141c68f89bafbc (git)
Affected: 0dc987b699ce4266450d407d6d79d41eab88c5d0 , < 3413881e1ecc3cba722a2e87ec099692eed5be28 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.0
Unaffected: 0 , < 6.0 (semver)
Unaffected: 6.1.23 , ≤ 6.1.* (semver)
Unaffected: 6.2.10 , ≤ 6.2.* (semver)
Unaffected: 6.3 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-53378",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-14T18:55:32.767182Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-14T19:03:03.870Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/i915/display/intel_dpt.c",
            "drivers/gpu/drm/i915/gem/i915_gem_object.h",
            "drivers/gpu/drm/i915/gem/i915_gem_object_types.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c781c107731fc09ce4330c8c636b8446d0f72aa4",
              "status": "affected",
              "version": "0dc987b699ce4266450d407d6d79d41eab88c5d0",
              "versionType": "git"
            },
            {
              "lessThan": "5390a02b4508416b9bee96674f141c68f89bafbc",
              "status": "affected",
              "version": "0dc987b699ce4266450d407d6d79d41eab88c5d0",
              "versionType": "git"
            },
            {
              "lessThan": "3413881e1ecc3cba722a2e87ec099692eed5be28",
              "status": "affected",
              "version": "0dc987b699ce4266450d407d6d79d41eab88c5d0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/i915/display/intel_dpt.c",
            "drivers/gpu/drm/i915/gem/i915_gem_object.h",
            "drivers/gpu/drm/i915/gem/i915_gem_object_types.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.23",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.2.*",
              "status": "unaffected",
              "version": "6.2.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.23",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2.10",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/dpt: Treat the DPT BO as a framebuffer\n\nCurrently i915_gem_object_is_framebuffer() doesn\u0027t treat the\nBO containing the framebuffer\u0027s DPT as a framebuffer itself.\nThis means eg. that the shrinker can evict the DPT BO while\nleaving the actual FB BO bound, when the DPT is allocated\nfrom regular shmem.\n\nThat causes an immediate oops during hibernate as we\ntry to rewrite the PTEs inside the already evicted\nDPT obj.\n\nTODO: presumably this might also be the reason for the\nDPT related display faults under heavy memory pressure,\nbut I\u0027m still not sure how that would happen as the object\nshould be pinned by intel_dpt_pin() while in active use by\nthe display engine...\n\n(cherry picked from commit 779cb5ba64ec7df80675a956c9022929514f517a)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached via local i915 display/GEM and system-suspend/resume (`intel_dpt_suspend`/`intel_dpt_resume` rewriting DPT PTEs), not via network protocols or adjacent-link frames.\nAC:L - An attacker can create tiled Gen13+ framebuffers (forcing smem DPT when stolen is exhausted), induce memory pressure so the shrinker reclaims the unpinned volatile DPT BO, then trigger suspend/resume; no race or layout outside attacker influence is required.\nPR:L - ADDFB2 needs only an unprivileged DRM primary-node open (typically video-group access), and suspend can be initiated by an active local session via logind without real root or init-namespace CAP_SYS_ADMIN.\nUI:N - The attacker can create the reclaimable DPT state and initiate suspend/resume themselves; no separate victim action is required.\nS:U - Impact is a same-kernel use-after-free of DPT backing pages within the host i915 authority; it does not cross a VM, IOMMU, or sandbox boundary.\nC:H - After shrinker put_pages, resume still writeqs through the stale `dpt-\u003eiomem` mapping of freed pages\u2014a UAF that can be reclaimed and leveraged for arbitrary kernel disclosure.\nI:H - The same dangling `dpt-\u003eiomem` UAF performs PTE writeqs into recycled pages, yielding a heap corruption/write primitive exploitable for control-flow hijacking.\nA:H - Rewriting PTEs in an already-evicted DPT object causes an immediate kernel oops during hibernate/resume (and related display faults under memory pressure), denying service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:13:46.218Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c781c107731fc09ce4330c8c636b8446d0f72aa4"
        },
        {
          "url": "https://git.kernel.org/stable/c/5390a02b4508416b9bee96674f141c68f89bafbc"
        },
        {
          "url": "https://git.kernel.org/stable/c/3413881e1ecc3cba722a2e87ec099692eed5be28"
        }
      ],
      "title": "drm/i915/dpt: Treat the DPT BO as a framebuffer",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53378",
    "datePublished": "2025-09-18T13:33:23.905Z",
    "dateReserved": "2025-09-17T14:54:09.735Z",
    "dateUpdated": "2026-08-05T09:13:46.218Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-53378",
      "date": "2026-09-14",
      "epss": "0.00151",
      "percentile": "0.04596"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-53378\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-09-18T14:15:40.710\",\"lastModified\":\"2026-08-04T10:19:04.407\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/i915/dpt: Treat the DPT BO as a framebuffer\\n\\nCurrently i915_gem_object_is_framebuffer() doesn\u0027t treat the\\nBO containing the framebuffer\u0027s DPT as a framebuffer itself.\\nThis means eg. that the shrinker can evict the DPT BO while\\nleaving the actual FB BO bound, when the DPT is allocated\\nfrom regular shmem.\\n\\nThat causes an immediate oops during hibernate as we\\ntry to rewrite the PTEs inside the already evicted\\nDPT obj.\\n\\nTODO: presumably this might also be the reason for the\\nDPT related display faults under heavy memory pressure,\\nbut I\u0027m still not sure how that would happen as the object\\nshould be pinned by intel_dpt_pin() while in active use by\\nthe display engine...\\n\\n(cherry picked from commit 779cb5ba64ec7df80675a956c9022929514f517a)\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/i915/display/intel_dpt.c\",\"drivers/gpu/drm/i915/gem/i915_gem_object.h\",\"drivers/gpu/drm/i915/gem/i915_gem_object_types.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"0dc987b699ce4266450d407d6d79d41eab88c5d0\",\"lessThan\":\"c781c107731fc09ce4330c8c636b8446d0f72aa4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0dc987b699ce4266450d407d6d79d41eab88c5d0\",\"lessThan\":\"5390a02b4508416b9bee96674f141c68f89bafbc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0dc987b699ce4266450d407d6d79d41eab88c5d0\",\"lessThan\":\"3413881e1ecc3cba722a2e87ec099692eed5be28\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/i915/display/intel_dpt.c\",\"drivers/gpu/drm/i915/gem/i915_gem_object.h\",\"drivers/gpu/drm/i915/gem/i915_gem_object_types.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.0\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.0\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.23\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.2.10\",\"lessThanOrEqual\":\"6.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.3\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-01-14T18:55:32.767182Z\",\"id\":\"CVE-2023-53378\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.0\",\"versionEndExcluding\":\"6.1.23\",\"matchCriteriaId\":\"6ED5E7EB-F90C-4BCC-9CE2-F20825826B30\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.2.10\",\"matchCriteriaId\":\"5178A008-E2D6-4093-BCD4-8A80523EE39E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.3:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B8E3B0E8-FA27-4305-87BB-AF6C25B160CB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.3:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"A47F0FC3-CE52-4BA1-BA51-22F783938431\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.3:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"3583026A-27EC-4A4C-850A-83F2AF970673\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.3:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"DC271202-7570-4505-89A4-D602D47BFD00\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3413881e1ecc3cba722a2e87ec099692eed5be28\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5390a02b4508416b9bee96674f141c68f89bafbc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c781c107731fc09ce4330c8c636b8446d0f72aa4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-05T11:27:22+00:00",
      "cve": "CVE-2023-53378",
      "id": "CVE-2023-53378",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:known_affected": "156",
      "product_status:known_not_affected": "118",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/i915/dpt: Treat the DPT BO as a framebuffer",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-53378.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-53378\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-01-14T18:55:32.767182Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"description\": \"CWE-noinfo Not enough information\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-01-14T18:55:28.752Z\"}}], \"cna\": {\"title\": \"drm/i915/dpt: Treat the DPT BO as a framebuffer\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerable path is reached via local i915 display/GEM and system-suspend/resume (`intel_dpt_suspend`/`intel_dpt_resume` rewriting DPT PTEs), not via network protocols or adjacent-link frames.\\nAC:L - An attacker can create tiled Gen13+ framebuffers (forcing smem DPT when stolen is exhausted), induce memory pressure so the shrinker reclaims the unpinned volatile DPT BO, then trigger suspend/resume; no race or layout outside attacker influence is required.\\nPR:L - ADDFB2 needs only an unprivileged DRM primary-node open (typically video-group access), and suspend can be initiated by an active local session via logind without real root or init-namespace CAP_SYS_ADMIN.\\nUI:N - The attacker can create the reclaimable DPT state and initiate suspend/resume themselves; no separate victim action is required.\\nS:U - Impact is a same-kernel use-after-free of DPT backing pages within the host i915 authority; it does not cross a VM, IOMMU, or sandbox boundary.\\nC:H - After shrinker put_pages, resume still writeqs through the stale `dpt-\u003eiomem` mapping of freed pages\\u2014a UAF that can be reclaimed and leveraged for arbitrary kernel disclosure.\\nI:H - The same dangling `dpt-\u003eiomem` UAF performs PTE writeqs into recycled pages, yielding a heap corruption/write primitive exploitable for control-flow hijacking.\\nA:H - Rewriting PTEs in an already-evicted DPT object causes an immediate kernel oops during hibernate/resume (and related display faults under memory pressure), denying service.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"0dc987b699ce4266450d407d6d79d41eab88c5d0\", \"lessThan\": \"c781c107731fc09ce4330c8c636b8446d0f72aa4\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0dc987b699ce4266450d407d6d79d41eab88c5d0\", \"lessThan\": \"5390a02b4508416b9bee96674f141c68f89bafbc\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0dc987b699ce4266450d407d6d79d41eab88c5d0\", \"lessThan\": \"3413881e1ecc3cba722a2e87ec099692eed5be28\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/gpu/drm/i915/display/intel_dpt.c\", \"drivers/gpu/drm/i915/gem/i915_gem_object.h\", \"drivers/gpu/drm/i915/gem/i915_gem_object_types.h\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.0\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.0\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.23\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.2.10\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.2.*\"}, {\"status\": \"unaffected\", \"version\": \"6.3\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/gpu/drm/i915/display/intel_dpt.c\", \"drivers/gpu/drm/i915/gem/i915_gem_object.h\", \"drivers/gpu/drm/i915/gem/i915_gem_object_types.h\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/c781c107731fc09ce4330c8c636b8446d0f72aa4\"}, {\"url\": \"https://git.kernel.org/stable/c/5390a02b4508416b9bee96674f141c68f89bafbc\"}, {\"url\": \"https://git.kernel.org/stable/c/3413881e1ecc3cba722a2e87ec099692eed5be28\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/i915/dpt: Treat the DPT BO as a framebuffer\\n\\nCurrently i915_gem_object_is_framebuffer() doesn\u0027t treat the\\nBO containing the framebuffer\u0027s DPT as a framebuffer itself.\\nThis means eg. that the shrinker can evict the DPT BO while\\nleaving the actual FB BO bound, when the DPT is allocated\\nfrom regular shmem.\\n\\nThat causes an immediate oops during hibernate as we\\ntry to rewrite the PTEs inside the already evicted\\nDPT obj.\\n\\nTODO: presumably this might also be the reason for the\\nDPT related display faults under heavy memory pressure,\\nbut I\u0027m still not sure how that would happen as the object\\nshould be pinned by intel_dpt_pin() while in active use by\\nthe display engine...\\n\\n(cherry picked from commit 779cb5ba64ec7df80675a956c9022929514f517a)\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.23\", \"versionStartIncluding\": \"6.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.2.10\", \"versionStartIncluding\": \"6.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.3\", \"versionStartIncluding\": \"6.0\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T09:13:46.218Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2023-53378\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T09:13:46.218Z\", \"dateReserved\": \"2025-09-17T14:54:09.735Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-09-18T13:33:23.905Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.