CVE-2023-54138

What it actually does

NULL pointer dereference during IRQ uninstall in the MSM DRM driver when the kms pointer is NULL due to early initialization errors or on non-DPU platforms.

Why it matters to the business

Potential kernel crashes on Linux systems using MSM graphics hardware leading to denial of service; low exploitation likelihood reduces urgency but widespread kernel use increases exposure in affected environments.

How an attack unfolds

An attacker triggers early initialization failure or operates on non-DPU platforms to reach the deinitialization path with a NULL kms pointer, causing the dereference during IRQ handling.

How to fix it

Update to Linux kernel commit e2d1cc82ad509c07a9ab0ab4bf88b6613fbf784b or later stable releases containing the fix for the MSM DRM NULL-deref on irq uninstall.

How to confirm the fix worked

Verify presence of commit e2d1cc82ad509c07a9ab0ab4bf88b6613fbf784b in kernel source; test initialization error paths and non-DPU platform deinitialization to confirm absence of NULL dereference.

Typical attack path

1. Trigger early DRM/MSM initialization error or boot on non-DPU platform
2. Invoke IRQ uninstall or driver deinitialization code path
3. Execute NULL dereference on kms pointer leading to kernel oops or panic

How to detect it

Review kernel logs and dmesg for oops or panic messages referencing drm/msm and NULL pointer during IRQ or deinitialization; check for crashes in early boot or driver unload scenarios.

• drm/msm.*NULL
• irq uninstall.*kms
• msm_drm.*oops

What your security team should do

• Apply the referenced kernel commit immediately on affected systems
• Monitor kernel logs for NULL dereference oops involving drm/msm
• Prioritize updates on systems using MSM graphics hardware