CVE-2023-54018: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54018 is a NULL pointer dereference vulnerability in the Linux kernel's DRM/MSM HDMI subsystem, specifically in the drm/msm/hdmi driver. The flaw arises from a missing return value check for alloc_ordered_workqueue, which can return NULL and subsequently cause a NULL pointer dereference in hdmi_hdcp.c and hdmi_hpd.c. The vulnerability was published on December 24, 2025, and affects Linux kernel versions starting from commit c6a57a50ad562a2e6fc6ac3218b710caea73a58b across multiple stable branches. No CVSS score has been formally assigned by NVD at this time; Feedly estimates the severity as Medium with an EPSS score of 0.000240 (Feedly, NVD).

The root cause is a missing NULL pointer check (CWE-476) after calling alloc_ordered_workqueue() in the MSM HDMI driver. If the kernel fails to allocate the workqueue — for example, under memory pressure — the returned NULL pointer is subsequently dereferenced in hdmi_hdcp.c (HDCP authentication logic) and hdmi_hpd.c (hot-plug detection logic), triggering a kernel panic. Exploitation requires local access to a system with a Qualcomm MSM HDMI-capable GPU and the ability to trigger the relevant code paths, typically during device initialization or HDMI hot-plug events. The fix, tracked on Patchwork at https://patchwork.freedesktop.org/patch/517211/, adds an explicit NULL check and appropriate error handling after the workqueue allocation call (NVD, Feedly).

Successful exploitation of this vulnerability can cause a kernel NULL pointer dereference, resulting in a system crash (kernel panic) and denial of service. The affected components — HDMI HDCP and hot-plug detection — are specific to systems using Qualcomm MSM/Adreno GPUs with HDMI output, limiting the scope primarily to embedded Linux devices, mobile platforms, and certain ARM-based systems. There is no evidence of confidentiality or integrity impact; the primary consequence is availability loss through a kernel crash (NVD).

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution associated with CVE-2023-54018. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is very low at 0.000240, reflecting a minimal probability of exploitation in the near term. Detection coverage exists via Nessus (plugin 280070) and Qualys (QID 761056) (Feedly, Tenable).

Patches have been backported to multiple Linux stable kernel branches. Fixed versions include: 4.14.308, 4.19.276, 5.4.235, 5.10.173, 5.15.99, 6.1.16, 6.2.3, and 6.3. Administrators running affected kernels on Qualcomm MSM HDMI-capable hardware should update to the appropriate patched stable release. The specific fix commits are available on kernel.org for each affected branch (NVD, Feedly).