CVE-2023-54261 in Linux
Summary
by MITRE • 12/30/2025
In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: Add missing gfx11 MQD manager callbacks
mqd_stride function was introduced in commit 2f77b9a242a2 ("drm/amdkfd: Update MQD management on multi XCC setup") but not assigned for gfx11. Fixes a NULL dereference in debugfs.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 04/27/2026
The vulnerability CVE-2023-54261 represents a critical missing implementation in the Linux kernel's graphics driver subsystem, specifically within the AMD Kernel Driver Framework component. This issue affects systems utilizing AMD GPU hardware through the direct rendering manager framework and exposes a NULL pointer dereference condition that can lead to system instability and potential privilege escalation. The flaw exists in the memory management subsystem responsible for handling multi-XCC (Cross-Chip) GPU configurations, where the MQD (Multi-Queue Descriptor) manager callbacks are improperly configured for the gfx11 GPU architecture.
The technical root cause stems from an incomplete code implementation where the mqd_stride function was introduced in commit 2f77b9a242a2 to address MQD management in multi-XCC setups but was never properly assigned for the gfx11 GPU generation. This function is essential for calculating memory stride values required for proper memory queue management in the graphics processing unit's memory subsystem. When debugfs operations attempt to access MQD information for gfx11 GPUs, the missing callback results in a NULL pointer dereference that crashes the kernel and potentially allows malicious users to exploit this condition for privilege escalation attacks. The vulnerability specifically impacts the drm/amdkfd subsystem which handles AMD GPU memory management and process scheduling within the kernel's graphics driver framework.
The operational impact of this vulnerability extends beyond simple system crashes to potentially enable privilege escalation attacks through kernel memory corruption. Attackers could leverage this NULL dereference to trigger kernel panics or, in more sophisticated scenarios, manipulate kernel memory structures to gain elevated privileges. The vulnerability affects systems running Linux kernels with AMD GPU support where debugfs operations are accessible, particularly in server environments or systems with multiple GPU configurations. The issue is particularly concerning for cloud infrastructure providers and enterprise environments that utilize AMD GPUs for compute workloads, as it could allow unauthorized users to compromise system integrity and potentially gain root access to affected systems.
Mitigation strategies for CVE-2023-54261 focus primarily on applying the official kernel patch that properly assigns the mqd_stride function for gfx11 GPU architectures. System administrators should prioritize updating to kernel versions that include the fix from commit 2f77b9a242a2 and subsequent related patches. Organizations should also implement monitoring for debugfs access patterns and kernel crash reports that might indicate exploitation attempts. Additional defensive measures include restricting debugfs access to authorized users only and implementing proper kernel hardening configurations. The vulnerability aligns with CWE-476 which describes NULL pointer dereference conditions, and could potentially map to ATT&CK technique T1068 which covers privilege escalation through kernel vulnerabilities. Regular kernel updates and vulnerability assessments remain critical for maintaining system security in environments utilizing AMD GPU hardware.