CVE-2023-53378: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-53378 is a vulnerability discovered in the Linux kernel, specifically affecting the DPT (Display Page Table) handling in the i915 graphics driver. The vulnerability was disclosed on September 18, 2025, and is rated with a CVSS v3 Base Score of 5.5 (Red Hat CVE).

The vulnerability exists because i915gemobjectisframebuffer() doesn't treat the BO (Buffer Object) containing the framebuffer's DPT as a framebuffer itself. This means that the shrinker can evict the DPT BO while leaving the actual FB BO bound, when the DPT is allocated from regular shmem (Ubuntu Security).

When exploited, this vulnerability causes an immediate oops during hibernate as the system attempts to rewrite the PTEs (Page Table Entries) inside the already evicted DPT object. Additionally, it may be related to DPT-related display faults under heavy memory pressure (Debian Security).

The vulnerability has been fixed in various Linux distributions. For example, Debian has addressed this in multiple versions: bullseye (5.10.237-1), bookworm (6.1.153-1), trixie (6.12.48-1), and forky (6.16.8-1) (Debian Security).