CVE-2023-53552
published 2025-10-04CVE-2023-53552: In the Linux kernel, the following vulnerability has been resolved: drm/i915: mark requests for GuC virtual engines to avoid use-after-free References to…
PriorityP339high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.15%
5.2th percentile
In the Linux kernel, the following vulnerability has been resolved:
drm/i915: mark requests for GuC virtual engines to avoid use-after-free
References to i915_requests may be trapped by userspace inside a
sync_file or dmabuf (dma-resv) and held indefinitely across different
proceses. To counter-act the memory leaks, we try to not to keep
references from the request past their completion.
On the other side on fence release we need to know if rq->engine
is valid and points to hw engine (true for non-virtual requests).
To make it possible extra bit has been added to rq->execution_mask,
for marking virtual engines.
(cherry picked from commit 280410677af763f3871b93e794a199cfcf6fb580)
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.55-1 (bookworm) | linux 6.1.55-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= bcb9aa45d5a0e11ef91245330c53cde214d15e8d < 8017a27cec32eac8c8f9430b0a3055840136b856 | 8017a27cec32eac8c8f9430b0a3055840136b856 |
| linux | linux | >= bcb9aa45d5a0e11ef91245330c53cde214d15e8d < 7fb464d52fa41c31a6fd1ad82888e67c65935d94 | 7fb464d52fa41c31a6fd1ad82888e67c65935d94 |
| linux | linux | >= bcb9aa45d5a0e11ef91245330c53cde214d15e8d < 5eefc5307c983b59344a4cb89009819f580c84fa | 5eefc5307c983b59344a4cb89009819f580c84fa |
| linux | linux_kernel | >= 0 < 6.1.55-1 | 6.1.55-1 |
| linux | linux_kernel | >= 0 < 6.5.6-1 | 6.5.6-1 |
| linux | linux_kernel | >= 0 < 6.5.6-1 | 6.5.6-1 |
| linux | linux_kernel | >= 6.0 < 6.1.54 | 6.1.54 |
| linux | linux_kernel | >= 6.2 < 6.5.4 | 6.5.4 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-j4wq-v2m2-959h: In the Linux kernel, the following vulnerability has been resolved:
drm/i915: mark requests for GuC virtual engines to avoid use-after-free
Referenc
ghsa_unreviewed·2025-10-04
CVE-2023-53552 [HIGH] CWE-416 GHSA-j4wq-v2m2-959h: In the Linux kernel, the following vulnerability has been resolved:
drm/i915: mark requests for GuC virtual engines to avoid use-after-free
Referenc
In the Linux kernel, the following vulnerability has been resolved:
drm/i915: mark requests for GuC virtual engines to avoid use-after-free
References to i915_requests may be trapped by userspace inside a
sync_file or dmabuf (dma-resv) and held indefinitely across different
proceses. To counter-act the memory leaks, we try to not to keep
references from the request past their completion.
On the other side on fence release we need to know if rq->engine
is valid and points to hw engine (true for non-virtual requests).
To make it possible extra bit has been added to rq->execution_mask,
for marking virtual engines.
(cherry picked from commit 280410677af763f3871b93e794a199cfcf6fb580)
OSV
CVE-2023-53552: In the Linux kernel, the following vulnerability has been resolved: drm/i915: mark requests for GuC virtual engines to avoid use-after-free References
osv·2025-10-04·CVSS 7.8
CVE-2023-53552 [HIGH] CVE-2023-53552: In the Linux kernel, the following vulnerability has been resolved: drm/i915: mark requests for GuC virtual engines to avoid use-after-free References
In the Linux kernel, the following vulnerability has been resolved: drm/i915: mark requests for GuC virtual engines to avoid use-after-free References to i915_requests may be trapped by userspace inside a sync_file or dmabuf (dma-resv) and held indefinitely across different proceses. To counter-act the memory leaks, we try to not to keep references from the request past their completion. On the other side on fence release we need to know if rq->engine is valid and points to hw engine (true for non-virtual requests). To make it possible extra bit has been added to rq->execution_mask, for marking virtual engines. (cherry picked from commit 280410677af763f3871b93e794a199cfcf6fb580)
Red Hat
kernel: drm/i915: mark requests for GuC virtual engines to avoid use-after-free
vendor_redhat·2025-10-04·CVSS 7.8
CVE-2023-53552 [HIGH] CWE-825 kernel: drm/i915: mark requests for GuC virtual engines to avoid use-after-free
kernel: drm/i915: mark requests for GuC virtual engines to avoid use-after-free
In the Linux kernel, the following vulnerability has been resolved:
drm/i915: mark requests for GuC virtual engines to avoid use-after-free
References to i915_requests may be trapped by userspace inside a
sync_file or dmabuf (dma-resv) and held indefinitely across different
proceses. To counter-act the memory leaks, we try to not to keep
references from the request past their completion.
On the other side on fence release we need to know if rq->engine
is valid and points to hw engine (true for non-virtual requests).
To make it possible extra bit has been added to rq->execution_mask,
for marking virtual engines.
(cherry picked from commit 280410677af763f3871b93e794a199cfcf6fb580)
A use-after-free vulnerability
Debian
CVE-2023-53552: linux - In the Linux kernel, the following vulnerability has been resolved: drm/i915: m...
vendor_debian·2023·CVSS 7.8
CVE-2023-53552 [HIGH] CVE-2023-53552: linux - In the Linux kernel, the following vulnerability has been resolved: drm/i915: m...
In the Linux kernel, the following vulnerability has been resolved: drm/i915: mark requests for GuC virtual engines to avoid use-after-free References to i915_requests may be trapped by userspace inside a sync_file or dmabuf (dma-resv) and held indefinitely across different proceses. To counter-act the memory leaks, we try to not to keep references from the request past their completion. On the other side on fence release we need to know if rq->engine is valid and points to hw engine (true for non-virtual requests). To make it possible extra bit has been added to rq->execution_mask, for marking virtual engines. (cherry picked from commit 280410677af763f3871b93e794a199cfcf6fb580)
Scope: local
bookworm: resolved (fixed in 6.1.55-1)
bullseye: resolved
forky: resolved (fixed in 6.5.6-1)
sid: r
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-10-04
Published