CVE-2023-52693

What it actually does

Failure of acpi_get_parent() in acpi_video_dev_register_backlight() can pass an uninitialized acpi_parent handle to acpi_get_pci_dev(), bypassing intended error handling for ACPI video backlight parent device lookup.

Why it matters to the business

Systems may experience unexpected ACPI video device registration failures or incorrect PCI parent detection, potentially leading to display or backlight issues on affected Linux kernels; high ecosystem prevalence amplifies patch urgency across distributions.

How an attack unfolds

An attacker with local access or ability to trigger ACPI mutex acquisition failures could cause acpi_get_parent() to fail, resulting in an uninitialized handle being processed by acpi_get_pci_dev() and potentially leading to invalid device operations or crashes.

How to fix it

Update to fixed kernel versions that include the error check for acpi_get_parent() result before setting the parent device; for Debian 13 packages, upgrade thunderbird to 1:115.2.0-1 or later and firefox-esr to 115.2.0esr-1 or later.

How to confirm the fix worked

Confirm presence of the upstream patch that adds explicit success check on acpi_get_parent() before using the parent handle; verify package versions match or exceed the listed fixed releases and test ACPI video backlight registration under error-injection scenarios.

Typical attack path

1. Trigger conditions that cause acpi_ut_acquire_mutex() to fail inside acpi_get_parent()
2. Allow acpi_video_dev_register_backlight() to continue without checking the return value
3. Pass uninitialized acpi_parent handle to acpi_get_pci_dev()
4. Induce incorrect PCI device detection or subsequent kernel instability

How to detect it

Review kernel logs for ACPI video registration errors or unexpected acpi_get_pci_dev() calls with invalid handles; correlate with mutex acquisition failures in ACPI paths.

What your security team should do

• Prioritize kernel and dependent package updates to the listed fixed versions within standard maintenance windows
• Monitor upstream Linux kernel changelogs for related ACPI video fixes
• Include ACPI subsystem error paths in future kernel fuzzing and static analysis runs