CVE-2023-53991: drm/msm/dpu: Disallow unallocated resources to be returned
In the Linux kernel, the following vulnerability has been resolved:
drm/msm/dpu: Disallow unallocated resources to be returned
In the event that the topology requests resources that have not been
created by the system (because they are typically not represented in
dpu_mdss_cfg ^1), the resource(s) in global_state (in this case DSC
blocks, until their allocation/assignment is being sanity-checked in
"drm/msm/dpu: Reject topologies for which no DSC blocks are available")
remain NULL but will still be returned out of
dpu_rm_get_assigned_resources, where the caller expects to get an array
containing num_blks valid pointers (but instead gets these NULLs).
To prevent this from happening, where null-pointer dereferences
typically result in a hard-to-debug platform lockup, num_blks shouldn't
increase past NULL blocks and will print an error and break instead.
After all, max_blks represents the static size of the maximum number of
blocks whereas the actual amount varies per platform.
^1: which can happen after a git rebase ended up moving additions to
_dpu_cfg to a different struct which has the same patch context.
Patchwork: https://patchwork.freedesktop.org/patch/517636/
Security readout for executives and security teams
Plain-English summary
CVE-2023-53991 is a Linux kernel display-driver flaw that can leave a system trying to use missing display resources. The reported result is usually a null-pointer dereference and potentially a platform lockup. Business impact is mainly availability for affected Linux devices, especially Qualcomm MSM display-stack systems.
Executive priority
Treat this as a targeted availability risk, not an internet-wide emergency. Patch affected device fleets through normal kernel maintenance, with higher priority for production embedded or appliance systems where display lockups affect service delivery.
Technical view
The drm/msm/dpu resource manager could return NULL entries when a topology requested DPU resources not present in platform configuration, including DSC blocks. Callers expected valid pointers for the requested block count, so this could trigger NULL dereferences. Kernel stable fixes stop counting past NULL blocks and log an error.
Likely exposure
Exposure appears limited to Linux kernels using the Qualcomm MSM DPU display driver and affected kernel ranges or downstream builds missing the stable fixes. General servers without this display stack are less likely to be exposed.
Exploitation context
The bundle does not cite active exploitation, public weaponization, CVSS, or a KEV listing. The described failure mode is a kernel null-pointer dereference leading to lockup, not confirmed code execution.
Researcher notes
The CVE record lacks CVSS, CWE, exploit details, and platform-specific affected-device mapping. Analysis should focus on whether downstream kernels include the drm/msm/dpu resource-manager fix and whether the hardware topology can request unavailable DSC resources.
Mitigation direction
Update to a kernel or vendor package containing the listed stable fixes.
Prioritize Qualcomm MSM/DPU display-stack devices and embedded Linux builds.
Check distribution advisories for backported fixes before relying on version numbers.
If no update is available, follow vendor guidance for affected display configurations.
Validation and detection
Inventory kernels and downstream vendor trees for affected drm/msm/dpu code.
Confirm whether Qualcomm MSM DPU display support is enabled or used.
Verify the relevant stable fix commit is present or backported.
Review crash logs for DPU resource-manager NULL dereference symptoms.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2023-53991 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
0CVSS vectors
3Timeline events
0ADP providers
6Source links
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
CVE publishedCVE Program
The CVE record was published.
Dec 24, 2025, 10:55 UTC (UTC+00:00)
CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.