{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2023-53545","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-10-04T15:14:15.920Z","datePublished":"2025-10-04T15:16:53.452Z","dateUpdated":"2026-08-05T09:14:44.686Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T09:14:44.686Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: unmap and remove csa_va properly\n\nRoot PD BO should be reserved before unmap and remove\na bo_va from VM otherwise lockdep will complain.\n\nv2: check fpriv->csa_va is not NULL instead of amdgpu_mcbp (christian)\n\n[14616.936827] WARNING: CPU: 6 PID: 1711 at drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c:1762 amdgpu_vm_bo_del+0x399/0x3f0 [amdgpu]\n[14616.937096] Call Trace:\n[14616.937097]  <TASK>\n[14616.937102]  amdgpu_driver_postclose_kms+0x249/0x2f0 [amdgpu]\n[14616.937187]  drm_file_free+0x1d6/0x300 [drm]\n[14616.937207]  drm_close_helper.isra.0+0x62/0x70 [drm]\n[14616.937220]  drm_release+0x5e/0x100 [drm]\n[14616.937234]  __fput+0x9f/0x280\n[14616.937239]  ____fput+0xe/0x20\n[14616.937241]  task_work_run+0x61/0x90\n[14616.937246]  exit_to_user_mode_prepare+0x215/0x220\n[14616.937251]  syscall_exit_to_user_mode+0x2a/0x60\n[14616.937254]  do_syscall_64+0x48/0x90\n[14616.937257]  entry_SYSCALL_64_after_hwframe+0x63/0xcd"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable code runs in the DRM file release path (`close()`/process exit on /dev/dri/renderD* → drm_release → amdgpu_driver_postclose_kms), which requires a local file descriptor on the GPU device node. There is no remote or adjacent-network path to this code.\nAC:L - Triggering the unlocked amdgpu_vm_bo_del() requires nothing more than closing the DRM fd, and the attacker controls both sides of the resulting race — one thread submits faulting GPU work or VRAM eviction pressure (driving amdgpu_vm_handle_fault/amdgpu_vm_bo_invalidate under the root PD reservation) while another loops open/close. On SR-IOV VFs the CSA path is taken with stock settings, requiring no special tuning.\nPR:L - Only an unprivileged local user with access to the DRM render node is needed — these are group-accessible on ordinary distributions and available to every app on Android; no capability check exists on the path from drm_release to amdgpu_driver_postclose_kms.\nUI:N - The attacker performs the fd close and the concurrent GPU submissions entirely within their own process; no victim action is involved.\nS:U - Corruption is confined to the guest/host kernel that owns the amdgpu VM; even on an SR-IOV virtual function the VF remains constrained by host GPU/IOMMU isolation, so no security authority is crossed.\nC:H - Unlocked removal from the vm->va interval tree and vm->freed list racing with locked traversals leaves freed amdgpu_bo_va_mapping objects reachable, and corrupted GPU page-table updates map DMA-visible memory, yielding an arbitrary-read primitive over kernel memory.\nI:H - The same rb-tree/list corruption and use-after-free on mapping structures provide a write primitive, and because the affected structures drive GPU PTE programming, an attacker can influence which physical memory the GPU is allowed to write.\nA:H - The path contains an explicit BUG_ON() plus the dma_resv_assert_held() WARN reported in the commit — the latter panics outright under panic_on_warn — and the underlying race produces oopses from torn interval-tree state on every fd close."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c","drivers/gpu/drm/amd/amdgpu/amdgpu_csa.h","drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c"],"versions":[{"version":"d38ceaf99ed015f2a0b9af3499791bd3a3daae21","lessThan":"1bc35e637a81dac5f5155e83a277c26708c4d4d7","status":"affected","versionType":"git"},{"version":"d38ceaf99ed015f2a0b9af3499791bd3a3daae21","lessThan":"ae325b245208394279a1dc412c831ebd71befb0d","status":"affected","versionType":"git"},{"version":"d38ceaf99ed015f2a0b9af3499791bd3a3daae21","lessThan":"a3a96bf843c356d1d9b2d7f6d0784b6ee28ca9d0","status":"affected","versionType":"git"},{"version":"d38ceaf99ed015f2a0b9af3499791bd3a3daae21","lessThan":"5daff15cd013422bc6d1efcfe82b586800025384","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c","drivers/gpu/drm/amd/amdgpu/amdgpu_csa.h","drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c"],"versions":[{"version":"4.2","status":"affected"},{"version":"0","lessThan":"4.2","status":"unaffected","versionType":"semver"},{"version":"5.15.209","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.167","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.4.12","lessThanOrEqual":"6.4.*","status":"unaffected","versionType":"semver"},{"version":"6.5","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2","versionEndExcluding":"5.15.209"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2","versionEndExcluding":"6.1.167"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2","versionEndExcluding":"6.4.12"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2","versionEndExcluding":"6.5"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/1bc35e637a81dac5f5155e83a277c26708c4d4d7"},{"url":"https://git.kernel.org/stable/c/ae325b245208394279a1dc412c831ebd71befb0d"},{"url":"https://git.kernel.org/stable/c/a3a96bf843c356d1d9b2d7f6d0784b6ee28ca9d0"},{"url":"https://git.kernel.org/stable/c/5daff15cd013422bc6d1efcfe82b586800025384"}],"title":"drm/amdgpu: unmap and remove csa_va properly","x_generator":{"engine":"bippy-1.2.0"}}}}