CVE-2023-52695

What it actually does

Null pointer dereference in drm/amd/display create_validate_stream_for_sink when writeback connectors are processed without type checking, allowing unhandled NULL access in the Linux kernel display stack.

Why it matters to the business

AMD GPU systems running affected kernels may suffer kernel crashes or instability, leading to downtime, loss of graphics workloads, and potential data corruption on servers or workstations with AMD hardware; high prevalence in Linux distributions increases exposure.

How an attack unfolds

An attacker with local access crafts conditions that invoke display stream validation for a writeback connector, bypassing the missing type check and triggering the null dereference to crash the kernel; no known remote or in-the-wild exploitation by named actors.

How to fix it

Upgrade to a fixed kernel version such as 6.7.2 or apply the commit 0fe85301b95077ac4fa4a91909d38b7341e81187 (or 7bbf3b67cb49d0f8a20e64b7473923041b758211) in stable trees; rebuild and reboot with the patched kernel.

How to confirm the fix worked

Verify the running kernel contains the fix by checking version against 6.7.2+ or inspecting the source for the connector type check in create_validate_stream_for_sink; test graphics initialization with writeback connectors enabled.

Typical attack path

1. Obtain local execution context on a Linux system with AMD display hardware
2. Trigger display or graphics operations that create a stream for a writeback connector
3. Invoke create_validate_stream_for_sink without prior connector type validation
4. Cause NULL pointer access leading to kernel oops or panic

How to detect it

Review kernel logs for oops/panic traces referencing drm/amd/display and create_validate_stream_for_sink; correlate with graphics or display initialization events.

What your security team should do

• Apply the kernel update to 6.7.2 or equivalent patched release immediately on all AMD GPU hosts
• Monitor for kernel panics in amd/display code paths until patching is complete
• Prioritize systems with high graphics workload or public-facing Linux instances