CVE-2023-54217
Description
In the Linux kernel, the following vulnerability has been resolved:
Revert "drm/msm: Add missing check and destroy for alloc_ordered_workqueue"
This reverts commit 643b7d0869cc7f1f7a5ac7ca6bd25d88f54e31d0.
A recent patch that tried to fix up the msm_drm_init() paths with respect to the workqueue but only ended up making things worse:
First, the newly added calls to msm_drm_uninit() on early errors would trigger NULL-pointer dereferences, for example, as the kms pointer would not have been initialised. (Note that these paths were also modified by a second broken error handling patch which in effect cancelled out this part when merged.)
Second, the newly added allocation sanity check would still leak the previously allocated drm device.
Instead of trying to salvage what was badly broken (and clearly not tested), let's revert the bad commit so that clean and backportable fixes can be added in its place.
Patchwork: https://patchwork.freedesktop.org/patch/525107/
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Reversion of a faulty patch in Linux kernel's drm/msm that caused NULL-pointer dereferences and memory leaks during error handling.
Vulnerability
Description
CVE-2023-54217 addresses a regression introduced by commit 643b7d0869cc in the Linux kernel's DRM subsystem for MSM. The original patch attempted to add missing checks and cleanup for an ordered workqueue in msm_drm_init(), but it inadvertently introduced NULL-pointer dereferences and memory leaks. Specifically, early error paths would call msm_drm_uninit() before the kms pointer was initialized, leading to crashes. Additionally, a sanity check on allocation would leak the previously allocated drm device.
Impact
An attacker with the ability to trigger error conditions during DRM initialization could cause a system crash (NULL-pointer dereference) or memory leak, resulting in denial of service. No other impact has been identified.
Mitigation
The fix is to revert the faulty commit. The reversion has been applied in the Linux kernel stable tree. Users should update to a version containing this revert or apply the patch directly.
AI Insight generated on May 19, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
1Patches
29078b4345877dfa70344d1b5Vulnerability mechanics
Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
2News mentions
0No linked articles in our index yet.