LiveActive security incident?Get immediate response
CVE Record

CVE-2023-54217: Revert "drm/msm: Add missing check and destroy for alloc_ordered_workqueue"

In the Linux kernel, the following vulnerability has been resolved: Revert "drm/msm: Add missing check and destroy for alloc_ordered_workqueue" This reverts commit 643b7d0869cc7f1f7a5ac7ca6bd25d88f54e31d0. A recent patch that tried to fix up the msm_drm_init() paths with respect to the workqueue but only ended up making things worse: First, the newly added calls to msm_drm_uninit() on early errors would trigger NULL-pointer dereferences, for example, as the kms pointer would not have been initialised. (Note that these paths were also modified by a second broken error handling patch which in effect cancelled out this part when merged.) Second, the newly added allocation sanity check would still leak the previously allocated drm device. Instead of trying to salvage what was badly broken (and clearly not tested), let's revert the bad commit so that clean and backportable fixes can be added in its place. Patchwork: https://patchwork.freedesktop.org/patch/525107/

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel flaw caused by a bad drm/msm driver cleanup patch. The sources describe early error paths that could trigger NULL-pointer crashes and leak an allocated DRM device. No public source in the bundle shows active exploitation or a business-impact rating.

Executive priority

Treat as a kernel patch-management item, not an emergency, unless affected drm/msm systems are business-critical or unstable. The available evidence lacks severity scoring and exploitation reports.

Technical view

The issue is tied to commit 643b7d0869cc7f1f7a5ac7ca6bd25d88f54e31d0 in Linux drm/msm initialization. Added msm_drm_uninit() calls could dereference uninitialized pointers, and an allocation check could leak the DRM device. The kernel fix reverts that bad commit so cleaner backportable fixes can follow.

Likely exposure

Exposure appears limited to Linux systems carrying the affected 6.3/6.4-era drm/msm code or the named commit. The bundle does not establish remote attack surface, privilege requirements, or distribution-specific package impact.

Exploitation context

CISA KEV is false, and the provided sources do not report active exploitation, public exploit code, or weaponized use. The described failure mode is kernel error handling during drm/msm initialization, not a documented remote attack path.

Researcher notes

The CVE record is sparse: no CVSS, CWE, exploit data, or detailed affected range beyond Linux 6.3/6.4-era entries and commit references. Analysis should remain commit- and vendor-advisory-driven.

Mitigation direction

  • Apply vendor-provided Linux kernel updates that include the referenced stable fixes.
  • Check distribution advisories before assuming upstream commit status equals package status.
  • Prioritize affected systems using drm/msm kernel functionality.
  • Avoid inventing compensating controls; follow kernel or distribution guidance.

Validation and detection

  • Inventory kernel versions and downstream package changelogs for the affected commits.
  • Check whether the running kernel includes the referenced stable commit fixes.
  • Confirm whether drm/msm functionality is present or enabled on in-scope systems.
  • Review crash logs for drm/msm initialization failures if exposure is suspected.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-54217 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
3Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux643b7d0869cc7f1f7a5ac7ca6bd25d88f54e31d0, 643b7d0869cc7f1f7a5ac7ca6bd25d88f54e31d0unaffected
LinuxLinux6.3, 0, 6.3.2, 6.4affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.