CVE-2023-53991: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-53991 is a null-pointer dereference vulnerability in the Linux kernel's DRM/MSM/DPU (Display Processing Unit) subsystem, specifically in the dpu_rm_get_assigned_resources function. The flaw occurs when display topology requests resources (such as DSC blocks) that have not been allocated in the system's dpu_mdss_cfg, causing NULL entries to be returned in place of valid block pointers. Affected kernel versions span from 5.7 through at least 6.2, with fixes backported to stable releases including 5.10.173, 5.15.99, 6.1.16, 6.2.3, and 6.3. The CVE was published on December 24, 2025, and NVD has not yet assigned a CVSS score as enrichment is not currently prioritized (Feedly).

The root cause is a NULL pointer dereference (CWE-476) in the dpu_rm_get_assigned_resources() function within the Linux kernel's drm/msm/dpu subsystem. When a display topology requests DSC (Display Stream Compression) blocks that are not represented in the platform's dpu_mdss_cfg — which can occur due to a git rebase inadvertently moving struct additions — the corresponding entries in global_state remain NULL. The function nonetheless increments num_blks and returns these NULL pointers to callers that expect an array of valid block pointers, leading to a null-pointer dereference that typically manifests as a hard-to-debug platform lockup. The fix prevents num_blks from incrementing past NULL blocks, printing an error and breaking the loop instead (Feedly, Patchwork).

Successful triggering of this vulnerability results in a null-pointer dereference in kernel space, causing a system crash or platform lockup — a denial-of-service condition affecting availability. The impact is limited to the local system running an affected Linux kernel with Qualcomm MSM/DPU display hardware, and there is no evidence of confidentiality or integrity impact. Lateral movement or data exfiltration are not associated with this vulnerability given its nature as a kernel display subsystem crash (Feedly).

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution associated with CVE-2023-53991. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection has been noted by Qualys (detection ID 761056) and Tenable (Nessus plugin 280010) (Feedly).

The Linux kernel project has released patches across multiple stable branches to address this vulnerability. Fixed versions include 5.10.173, 5.15.99, 6.1.16, 6.2.3, and 6.3. Administrators running affected kernels on Qualcomm MSM/DPU-based platforms should update to the patched stable releases. The relevant upstream commits are available at the kernel.org stable repository (Feedly):

• 8dbd54d679e3 (5.10.x branch)
• 9e1e236acdc4 (6.1.x branch)
• 9fe3644c720a (6.2.x branch)
• abc40122d9a6 (6.3 branch)
• bf661c5e3bc4 (5.15.x branch)