LiveActive security incident?Get immediate response
CVE Record

CVE-2023-53991: drm/msm/dpu: Disallow unallocated resources to be returned

In the Linux kernel, the following vulnerability has been resolved: drm/msm/dpu: Disallow unallocated resources to be returned In the event that the topology requests resources that have not been created by the system (because they are typically not represented in dpu_mdss_cfg ^1), the resource(s) in global_state (in this case DSC blocks, until their allocation/assignment is being sanity-checked in "drm/msm/dpu: Reject topologies for which no DSC blocks are available") remain NULL but will still be returned out of dpu_rm_get_assigned_resources, where the caller expects to get an array containing num_blks valid pointers (but instead gets these NULLs). To prevent this from happening, where null-pointer dereferences typically result in a hard-to-debug platform lockup, num_blks shouldn't increase past NULL blocks and will print an error and break instead. After all, max_blks represents the static size of the maximum number of blocks whereas the actual amount varies per platform. ^1: which can happen after a git rebase ended up moving additions to _dpu_cfg to a different struct which has the same patch context. Patchwork: https://patchwork.freedesktop.org/patch/517636/

UnknownCVSS not scoredNot KEV-listedUpdated
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2023-53991 is a Linux kernel display-driver flaw that can leave a system trying to use missing display resources. The reported result is usually a null-pointer dereference and potentially a platform lockup. Business impact is mainly availability for affected Linux devices, especially Qualcomm MSM display-stack systems.

Executive priority

Treat this as a targeted availability risk, not an internet-wide emergency. Patch affected device fleets through normal kernel maintenance, with higher priority for production embedded or appliance systems where display lockups affect service delivery.

Technical view

The drm/msm/dpu resource manager could return NULL entries when a topology requested DPU resources not present in platform configuration, including DSC blocks. Callers expected valid pointers for the requested block count, so this could trigger NULL dereferences. Kernel stable fixes stop counting past NULL blocks and log an error.

Likely exposure

Exposure appears limited to Linux kernels using the Qualcomm MSM DPU display driver and affected kernel ranges or downstream builds missing the stable fixes. General servers without this display stack are less likely to be exposed.

Exploitation context

The bundle does not cite active exploitation, public weaponization, CVSS, or a KEV listing. The described failure mode is a kernel null-pointer dereference leading to lockup, not confirmed code execution.

Researcher notes

The CVE record lacks CVSS, CWE, exploit details, and platform-specific affected-device mapping. Analysis should focus on whether downstream kernels include the drm/msm/dpu resource-manager fix and whether the hardware topology can request unavailable DSC resources.

Mitigation direction

  • Update to a kernel or vendor package containing the listed stable fixes.
  • Prioritize Qualcomm MSM/DPU display-stack devices and embedded Linux builds.
  • Check distribution advisories for backported fixes before relying on version numbers.
  • If no update is available, follow vendor guidance for affected display configurations.

Validation and detection

  • Inventory kernels and downstream vendor trees for affected drm/msm/dpu code.
  • Confirm whether Qualcomm MSM DPU display support is enabled or used.
  • Verify the relevant stable fix commit is present or backported.
  • Review crash logs for DPU resource-manager NULL dereference symptoms.
Prepared
Confidence
medium
Sources
7

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-53991 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
6Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxbb00a452d6f77391441ef7df48f7115dd459cd2f, bb00a452d6f77391441ef7df48f7115dd459cd2f, bb00a452d6f77391441ef7df48f7115dd459cd2f, bb00a452d6f77391441ef7df48f7115dd459cd2f, bb00a452d6f77391441ef7df48f7115dd459cd2funaffected
LinuxLinux5.7, 0, 5.10.173, 5.15.99, 6.1.16, 6.2.3, 6.3affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.