LiveActive security incident?Get immediate response
CVE Record

CVE-2023-53193: drm/amdgpu: fix amdgpu_irq_put call trace in gmc_v10_0_hw_fini

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix amdgpu_irq_put call trace in gmc_v10_0_hw_fini The gmc.ecc_irq is enabled by firmware per IFWI setting, and the host driver is not privileged to enable/disable the interrupt. So, it is meaningless to use the amdgpu_irq_put function in gmc_v10_0_hw_fini, which also leads to the call trace. [ 82.340264] Call Trace: [ 82.340265] <TASK> [ 82.340269] gmc_v10_0_hw_fini+0x83/0xa0 [amdgpu] [ 82.340447] gmc_v10_0_suspend+0xe/0x20 [amdgpu] [ 82.340623] amdgpu_device_ip_suspend_phase2+0x127/0x1c0 [amdgpu] [ 82.340789] amdgpu_device_ip_suspend+0x3d/0x80 [amdgpu] [ 82.340955] amdgpu_device_pre_asic_reset+0xdd/0x2b0 [amdgpu] [ 82.341122] amdgpu_device_gpu_recover.cold+0x4dd/0xbb2 [amdgpu] [ 82.341359] amdgpu_debugfs_reset_work+0x4c/0x70 [amdgpu] [ 82.341529] process_one_work+0x21d/0x3f0 [ 82.341535] worker_thread+0x1fa/0x3c0 [ 82.341538] ? process_one_work+0x3f0/0x3f0 [ 82.341540] kthread+0xff/0x130 [ 82.341544] ? kthread_complete_and_exit+0x20/0x20 [ 82.341547] ret_from_fork+0x22/0x30

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysislow

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel AMDGPU driver issue. On some AMD GPU systems, the driver incorrectly tries to release an ECC interrupt controlled by firmware, causing a kernel call trace during GPU suspend or recovery paths. The public sources do not show remote exploitation, privilege escalation, data exposure, or active exploitation.

Executive priority

Treat as a low-priority stability and hygiene update unless AMDGPU fleet reliability is operationally critical. There is no cited evidence of exploitation or direct data compromise, but affected kernels should still be updated through normal kernel maintenance channels.

Technical view

The fix removes an inappropriate amdgpu_irq_put use in gmc_v10_0_hw_fini because gmc.ecc_irq is enabled by firmware and not host-driver controlled. The observed impact is a call trace through amdgpu suspend/reset recovery code. Affected Linux kernel versions and stable commit references are listed, but CVSS, CWE, and exploitability details are absent.

Likely exposure

Exposure appears limited to Linux systems using the AMDGPU driver on hardware and firmware configurations where gmc.ecc_irq is firmware-enabled. The bundle lists affected Linux versions including 6.1.29, 6.2.16, 6.3.3, 6.3, 6.4, and commit identifiers, but distribution backports require vendor confirmation.

Exploitation context

The sources do not report active exploitation, KEV listing, public exploit code, or attacker-controlled triggering. The described condition occurs in driver finalization, suspend, reset, or GPU recovery paths and is presented as a kernel call trace rather than a demonstrated compromise primitive.

Researcher notes

Evidence supports a narrow AMDGPU driver bug involving firmware-owned ECC interrupt handling. The CVE metadata lacks CVSS, CWE, and concrete security impact. Researchers should avoid assuming exploitability from the CVE assignment alone and should verify branch-specific fixes against kernel stable references.

Mitigation direction

  • Update to a kernel containing one of the referenced stable fixes.
  • Check Linux distribution advisories for backported CVE-2023-53193 coverage.
  • Prioritize AMDGPU systems that use suspend, reset, or GPU recovery workflows.
  • If no vendor package exists, follow kernel or distribution guidance.
  • Monitor kernel logs for related AMDGPU call traces until patched.

Validation and detection

  • Inventory Linux hosts using the AMDGPU driver.
  • Confirm kernel version and distribution package changelog status.
  • Verify the kernel includes a referenced stable fix commit.
  • Review logs for gmc_v10_0_hw_fini or amdgpu_irq_put call traces.
  • Track whether vendors classify the issue with security impact.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-53193 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
5Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxbef774effb278ff0b65ea2dbaa1ab32ba6a1dc13, 56a03f64fedf49a4f81c5605167b6e7bb0300a59, c8b5a95b570949536a2b75cd8fc4f1de0bc60629, c8b5a95b570949536a2b75cd8fc4f1de0bc60629unaffected
LinuxLinux6.3, 0, 6.1.29, 6.2.16, 6.3.3, 6.4affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.