CVE-2023-3220

What it actually does

Missing validation of kzalloc() return value in dpu_crtc_atomic_check allows NULL pointer dereference when memory allocation fails, triggering kernel panic in the MSM DRM display driver.

Why it matters to the business

Systems using affected Linux kernels may experience unexpected crashes or denial of service during graphics operations under memory pressure, disrupting workloads on servers, desktops, or embedded devices.

How an attack unfolds

A local attacker triggers the dpu_crtc_atomic_check path in the DRM subsystem under low-memory conditions so that kzalloc returns NULL; the unchecked pointer is later dereferenced, causing an immediate kernel oops and system halt.

How to fix it

Upgrade the Linux kernel to a version containing commit 93340e10b9c5fc86730d149636e0aa8b47bb5a34 or later; rebuild and reboot with the patched kernel image.

How to confirm the fix worked

Verify the running kernel contains commit 93340e10b9c5fc86730d149636e0aa8b47bb5a34 via git log or uname -r against a known-good build; confirm the kzalloc return-value check is present in drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c.

Typical attack path

1. Obtain local user or process access on the target system
2. Induce memory pressure or invoke display configuration changes that reach dpu_crtc_atomic_check
3. Trigger kzalloc failure so the unchecked NULL pointer is dereferenced
4. Kernel panics and the system becomes unavailable

How to detect it

Inspect kernel logs (dmesg, /var/log/kern.log, journalctl) for oops or panic messages referencing dpu_crtc_atomic_check, NULL pointer dereference, or the MSM DRM driver; correlate with low-memory conditions or display reconfiguration events.

• dpu_crtc_atomic_check
• NULL pointer dereference
• drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c

What your security team should do

• Prioritize kernel upgrade to the fixed commit on all affected systems
• Test the patched kernel in a staging environment before broad deployment
• Monitor vendor or distribution security advisories for backported fixes