CVE-2023-53378 in Linux
Summary
by MITRE • 09/18/2025
In the Linux kernel, the following vulnerability has been resolved:
drm/i915/dpt: Treat the DPT BO as a framebuffer
Currently i915_gem_object_is_framebuffer() doesn't treat the BO containing the framebuffer's DPT as a framebuffer itself. This means eg. that the shrinker can evict the DPT BO while leaving the actual FB BO bound, when the DPT is allocated from regular shmem.
That causes an immediate oops during hibernate as we try to rewrite the PTEs inside the already evicted DPT obj.
TODO: presumably this might also be the reason for the DPT related display faults under heavy memory pressure, but I'm still not sure how that would happen as the object should be pinned by intel_dpt_pin() while in active use by the display engine...
(cherry picked from commit 779cb5ba64ec7df80675a956c9022929514f517a)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 12/12/2025
The vulnerability CVE-2023-53378 resides within the Linux kernel's graphics subsystem, specifically affecting the intel i915 driver's handling of display page tables. This issue represents a critical memory management flaw that can lead to system instability and potential denial of service conditions. The vulnerability stems from an incorrect classification of graphics buffer objects within the kernel's memory subsystem, where the driver fails to properly recognize certain buffer objects as framebuffer components. This misclassification creates a dangerous scenario where the kernel's memory management system can evict critical display page table objects while leaving other framebuffer components in memory, leading to system crashes during critical operations such as hibernation.
The technical flaw manifests in the i915_gem_object_is_framebuffer() function which incorrectly excludes display page table buffer objects from being treated as framebuffer components. This function serves as a critical decision point in the kernel's memory management logic, determining which objects should be protected from eviction during memory pressure conditions. When the DPT (Display Page Table) buffer object is allocated from regular shmem memory instead of specialized graphics memory, the kernel's memory shrinker can evict this object while leaving the actual framebuffer object bound. This creates a race condition where the system attempts to access memory that has already been evicted, resulting in immediate kernel oops during hibernation operations. The vulnerability operates at the intersection of memory management and graphics subsystems, making it particularly dangerous as it can affect both system stability and display functionality.
The operational impact of this vulnerability extends beyond simple system crashes to include potential data corruption and display faults under memory pressure conditions. During hibernation, the kernel attempts to rewrite page table entries for the evicted DPT object, which triggers immediate system panics due to accessing freed memory locations. The vulnerability's potential for causing display faults under heavy memory pressure suggests that it may also affect normal system operation, not just critical shutdown scenarios. This issue affects systems utilizing Intel graphics hardware with the i915 driver, particularly those with memory-constrained environments where the kernel's memory management decisions become critical. The vulnerability's severity is amplified by the fact that it can manifest during both normal operation and system power management events, making it a persistent threat to system reliability.
The mitigation strategy involves ensuring that display page table buffer objects are properly classified as framebuffer components within the kernel's memory management subsystem. This requires updating the i915_gem_object_is_framebuffer() function to correctly identify and protect DPT buffer objects from eviction. The fix implemented in commit 779cb5ba64ec7df80675a956c9022929514f517a addresses the core issue by treating DPT buffer objects as framebuffer components, thereby preventing their eviction during memory pressure conditions. Organizations should apply the patched kernel version immediately, particularly those running systems with Intel graphics hardware that may experience hibernation or memory pressure scenarios. The solution aligns with CWE-476 which addresses null pointer dereferences and memory management issues, and follows ATT&CK techniques related to privilege escalation and system stability manipulation through kernel-level memory corruption. This vulnerability demonstrates the critical importance of proper memory classification in graphics drivers and the potential for seemingly minor memory management decisions to cause catastrophic system failures.