CVE-2023-53806 (GCVE-0-2023-53806)
Vulnerability from cvelistv5
Published
2025-12-09 00:01
Modified
2026-08-05 09:16
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: populate subvp cmd info only for the top pipe [Why] System restart observed while changing the display resolution to 8k with extended mode. Sytem restart was caused by a page fault. [How] When the driver populates subvp info it did it for both the pipes using vblank which caused an outof bounds array access causing the page fault. added checks to allow the top pipe only to fix this issue.
References
Impacted products
Vendor Product Version
Linux Linux Version: 4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c
Version: 4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c
Version: 4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "92e6c79acad4b96efeff261d27bdbd8089a7dd24",
              "status": "affected",
              "version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c",
              "versionType": "git"
            },
            {
              "lessThan": "375d192eb1f1d9229a6d994da7ba31f3582b106b",
              "status": "affected",
              "version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c",
              "versionType": "git"
            },
            {
              "lessThan": "9bb10b7aaec3b6278f9cc410c17dcaa129bbbbf0",
              "status": "affected",
              "version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.15"
            },
            {
              "lessThan": "4.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.30",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.3.*",
              "status": "unaffected",
              "version": "6.3.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.4",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.30",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3.4",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: populate subvp cmd info only for the top pipe\n\n[Why]\nSystem restart observed while changing the display resolution\nto 8k with extended mode. Sytem restart was caused by a page fault.\n\n[How]\nWhen the driver populates subvp info it did it for both the pipes using\nvblank which caused an outof bounds array access causing the page fault.\nadded checks to allow the top pipe only to fix this issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached only through DRM modeset ioctls (`DRM_IOCTL_MODE_ATOMIC`/`SETCRTC`) on the local `/dev/dri/card0` device node, driving amdgpu\u0027s atomic commit into `dcn32_commit_subvp_config()`. There is no network or remote input involved.\nAC:L - A local attacker holding DRM master can repeatedly issue atomic commits with high-resolution/multi-display configurations that force ODM/MPC pipe splits alongside a SubVP stream, deterministically pushing `cmd_pipe_index` past 1. No race or unpredictable memory-layout condition is involved \u2014 the overflow is a fixed-offset write that happens every time the pipe topology is hit.\nPR:L - Only an unprivileged local user with access to the DRM primary node is needed \u2014 the logged-in console/session user is granted this via logind ACLs (or `video` group membership), and DRM master is obtainable without root. No capability check exists anywhere on the path from the ioctl to `dc_dmub_setup_subvp_dmub_command()`.\nUI:N - The attacker performs the modeset themselves via ioctl; no action by another user or victim is required to reach the overflowing loop.\nS:U - The out-of-bounds write corrupts the kernel\u0027s own stack within the same security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - Up to 56 bytes of kernel stack beyond the 64-byte `union dmub_rb_cmd` local are overwritten with mode-derived values, corrupting saved registers, pointers, and the return-address region of the caller\u0027s frame. Such stack corruption is leverageable to redirect subsequent kernel operations and disclose arbitrary kernel memory.\nI:H - This is an out-of-bounds stack write with partially attacker-influenced content (display timings supplied through the requested modeline), which per kernel scoring practice constitutes a high integrity impact \u2014 it can smash the stack canary and return address, giving a path to control-flow hijacking and arbitrary modification of kernel state.\nA:H - The bug was reported as causing a page fault and full system restart when changing to 8K in extended mode; stack smashing reliably produces an oops, stack-protector panic, or hard hang, taking down the machine."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:16:08.328Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/92e6c79acad4b96efeff261d27bdbd8089a7dd24"
        },
        {
          "url": "https://git.kernel.org/stable/c/375d192eb1f1d9229a6d994da7ba31f3582b106b"
        },
        {
          "url": "https://git.kernel.org/stable/c/9bb10b7aaec3b6278f9cc410c17dcaa129bbbbf0"
        }
      ],
      "title": "drm/amd/display: populate subvp cmd info only for the top pipe",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53806",
    "datePublished": "2025-12-09T00:01:04.413Z",
    "dateReserved": "2025-12-08T23:58:35.276Z",
    "dateUpdated": "2026-08-05T09:16:08.328Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.