CVE-2023-52788

What it actually does

NULL pointer dereference in i915/perf subsystem when the perf interface is unavailable, triggered during drm_dbg() calls that assume a valid interface pointer.

Why it matters to the business

Potential kernel crashes or denial of service on Linux systems with Intel graphics hardware, affecting stability of servers, workstations, and embedded devices; low exploitation likelihood reduces immediate risk but still requires patching across large fleets.

How an attack unfolds

An attacker with local access invokes operations on the i915 perf interface when it has not been initialized, causing the kernel to dereference a NULL pointer during debug logging and resulting in a crash; no named threat actors are known to be actively exploiting this issue.

How to fix it

Upgrade Linux kernel to version 5.15.140 or later, or apply commit 1566e8be73fd5fa424e88d2a4cffdc34f970f0e1 in the stable tree; rebuild and reboot affected systems.

How to confirm the fix worked

Verify running kernel version is at or above the fixed release; inspect dmesg or kernel logs for absence of i915 perf NULL dereference warnings after upgrade.

Typical attack path

1. Obtain local user access on a Linux system with Intel i915 graphics
2. Trigger perf interface usage or related ioctls when the interface is disabled or unavailable
3. Cause drm_dbg() to dereference the NULL perf pointer
4. Trigger kernel oops or panic leading to denial of service

How to detect it

Review kernel logs for i915 perf NULL pointer dereference oops messages; correlate with process activity invoking graphics perf ioctls around the time of any unexpected reboots or panics.

What your security team should do

• Prioritize patching production systems with Intel graphics within standard maintenance windows given low EPSS and lack of KEV listing
• Monitor kernel update channels for backports to older LTS branches
• Test graphics workloads post-upgrade to confirm perf interface stability