CVE-2023-53534: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-53534 is a vulnerability in the Linux kernel's MediaTek DRM CRTC component, discovered and disclosed on October 4, 2025. The vulnerability exists in the handling of devm_kcalloc return values, where missing checks could lead to NULL pointer dereference (NVD, Red Hat).

The vulnerability stems from insufficient validation of devmkcalloc return values in the drm/mediatek mtkdrmcrtc component. The function devmkcalloc may return NULL, but the code failed to implement proper checks for this condition, potentially leading to NULL pointer dereference. The vulnerability has been assigned a CVSS v3.1 base score with vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, indicating local access requirements and potential high impact on availability (Red Hat).

The vulnerability primarily affects system availability through potential NULL pointer dereference, which could lead to system crashes or denial of service. The CVSS scoring indicates no impact on confidentiality or integrity, but a high impact on system availability (Red Hat).

Multiple Linux distributions have released fixes for this vulnerability. Ubuntu has addressed it in various kernel versions, including linux-hwe-5.15 (5.15.0-75.82~20.04.1) and several other kernel variants. Red Hat Enterprise Linux versions 6 through 10 are marked as not affected (Ubuntu, Red Hat).