LiveActive security incident?Get immediate response
CVE Record

CVE-2023-54018: drm/msm/hdmi: Add missing check for alloc_ordered_workqueue

In the Linux kernel, the following vulnerability has been resolved: drm/msm/hdmi: Add missing check for alloc_ordered_workqueue Add check for the return value of alloc_ordered_workqueue as it may return NULL pointer and cause NULL pointer dereference in `hdmi_hdcp.c` and `hdmi_hpd.c`. Patchwork: https://patchwork.freedesktop.org/patch/517211/

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysislow

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel reliability flaw in the Qualcomm MSM HDMI driver. If an internal workqueue allocation fails, the driver may dereference a NULL pointer and crash kernel code. The provided sources do not show data theft, privilege escalation, or active exploitation.

Executive priority

Handle through normal kernel maintenance unless affected devices are critical, crash-sensitive, or hard to recover remotely. There is no source-backed evidence here for emergency response, active exploitation, or direct compromise impact.

Technical view

The fix adds missing return-value checks for alloc_ordered_workqueue in drm/msm/hdmi code paths, specifically hdmi_hdcp.c and hdmi_hpd.c. Without the check, allocation failure can lead to a NULL pointer dereference. The CVE record lists Linux kernel versions/commits as affected and stable kernel commits as references.

Likely exposure

Exposure is most likely on Linux systems using kernels that include the affected drm/msm HDMI driver code. This is particularly relevant to systems with Qualcomm MSM HDMI support enabled. Fleets without that driver built or loaded are less likely to be exposed.

Exploitation context

The bundle marks KEV as false and provides no cited evidence of exploitation in the wild. The described failure requires an allocation returning NULL and appears to result in a kernel NULL pointer dereference, mainly suggesting denial-of-service or instability risk.

Researcher notes

Evidence is limited to the CVE description and linked stable kernel commits. No CVSS, CWE, exploit details, or vendor advisory text is included. Treat impact as a NULL pointer dereference in a specific DRM HDMI driver path unless additional sources expand scope.

Mitigation direction

  • Update to a vendor kernel that includes the linked stable fixes.
  • Prioritize devices using Qualcomm MSM HDMI or HDCP functionality.
  • Check distribution or device-vendor advisories for fixed kernel package versions.
  • If patching is delayed, assess whether the affected driver can be disabled safely.

Validation and detection

  • Inventory kernel versions across affected Linux systems.
  • Check whether drm/msm HDMI support is built, loaded, or used.
  • Confirm the relevant stable fix commit is present in deployed kernel sources.
  • Review vendor kernel changelogs for CVE-2023-54018 or the referenced commits.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-54018 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
9Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxc6a57a50ad562a2e6fc6ac3218b710caea73a58b, c6a57a50ad562a2e6fc6ac3218b710caea73a58b, c6a57a50ad562a2e6fc6ac3218b710caea73a58b, c6a57a50ad562a2e6fc6ac3218b710caea73a58b, c6a57a50ad562a2e6fc6ac3218b710caea73a58b, c6a57a50ad562a2e6fc6ac3218b710caea73a58b, c6a57a50ad562a2e6fc6ac3218b710caea73a58b, c6a57a50ad562a2e6fc6ac3218b710caea73a58bunaffected
LinuxLinux4.3, 0, 4.14.308, 4.19.276, 5.4.235, 5.10.173, 5.15.99, 6.1.16, 6.2.3, 6.3affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.