Executive brief
A use-after-free vulnerability exists in the Linux kernel's MSM DisplayPort driver when auxiliary bus devices are not properly cleaned up during driver unbind or error conditions. This could allow an attacker with local access to trigger a kernel crash or potentially execute code by causing the panel driver to access freed memory regions used by the DisplayPort controller.
Technical details
The vulnerability is a use-after-free (CWE-416) in the drm/msm/dp DisplayPort controller driver. The root cause is improper lifecycle management of auxiliary bus devices: devres-based cleanup was tied to the DPU device structure which may be torn down after the DP controller, leaving dangling pointers. When the EDP panel driver attempts to read EDID information, it accesses freed DP resources. The fix explicitly depopulates the aux bus in both the error path of dp_display_get_next_bridge() and in the component unbind path (dp_display_unbind), ensuring proper cleanup order. Attack preconditions include local system access and the ability to trigger probe deferral or unbind events. No network vector exists.
Affected products
- Linux Linux kernel 5.0 through 6.4 and later (prior to fix commit a7bfb2ad2184a1fba78be35209b6019aa8cc8d4d)
Timeline
- 2023-06-12: disclosed: Patch authored by Bjorn Andersson
- 2023-06-15: patched: Fix merged into mainline (commit a7bfb2ad2184a1fba78be35209b6019aa8cc8d4d)
- 2025-12-09: advisory: CVE-2023-53851 assigned and published