CVE-2023-54122

What it actually does

Unconditional dereference of a kzalloc return value for cstate in the MSM DPU DRM driver can cause a NULL pointer dereference inside __drm_atomic_helper_crtc_reset when the allocation fails.

Why it matters to the business

Kernel panic or driver crash in graphics/display paths can produce sudden system instability or denial of service on affected Linux kernels; the issue affects any system using the MSM DPU hardware with atomic modesetting.

How an attack unfolds

An attacker with local access triggers the DRM atomic commit path under memory pressure so that kzalloc for the CRTC state returns NULL; the subsequent unchecked dereference in the helper function then crashes the kernel.

How to fix it

Update the Linux kernel to commit a6afb8293ec0932f4ed0b7aecfc0ccc00f44dc2b or any later stable release that contains the NULL check for cstate before calling __drm_atomic_helper_crtc_reset.

How to confirm the fix worked

Confirm the presence of the kzalloc failure check on cstate immediately before the call to __drm_atomic_helper_crtc_reset in the MSM DPU reset path; review dmesg or kernel logs for NULL dereference oopses referencing drm_atomic_helper_crtc_reset on pre-fix kernels.

Typical attack path

1. Obtain local code execution on a system with MSM DPU DRM driver loaded
2. Induce memory exhaustion while performing atomic modeset operations
3. Force the kzalloc for cstate to fail
4. Trigger __drm_atomic_helper_crtc_reset to dereference the NULL pointer

How to detect it

Search kernel logs and crash dumps for NULL pointer dereference faults originating from __drm_atomic_helper_crtc_reset or drm_atomic_helper_crtc_reset in the MSM DPU code path; no persistent artifacts remain after reboot.

What your security team should do

• Prioritize kernel updates containing commit a6afb8293ec0932f4ed0b7aecfc0ccc00f44dc2b on all MSM DPU-based devices
• Apply the fix during the next scheduled kernel maintenance window
• Monitor for kernel oops reports referencing the DRM atomic helper on unpatched systems