CVE-2023-54116: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54116 is a Linux kernel vulnerability in the drm/fbdev-generic subsystem that allows a potential out-of-bounds memory access. The issue arises when the fbdev test of IGT (Intel GPU Tools) writes past the end of file (EOF), triggering an out-of-bounds access in DRM drivers using fbdev-generic. This can cause a kernel hang or crash, as demonstrated on x86+ast2400 platforms at 1680x1050 resolution. The vulnerability was published on December 24, 2025, and affects the Linux kernel (Feedly). No CVSS score has been officially assigned at this time.

The root cause is an improper bounds check (CWE-125: Out-of-bounds Read / CWE-787: Out-of-bounds Write) in the drm_fbdev_generic_helper_fb_dirty function within the Linux kernel's drm/fbdev-generic module. When the IGT fbdev test performs a write operation past EOF, the kernel does not properly validate the memory region before executing a memcpy via memcpy_erms, resulting in access beyond the allocated framebuffer memory. The crash manifests as a kernel Oops in the drm_fb_helper_damage_work workqueue handler, with the faulting instruction at memcpy_erms+0xa/0x20 (Feedly). Fixes are tracked in kernel stable commits 251653fa974e, c8687694bb1f, and efd2821b8abe.

Successful triggering of this vulnerability results in a kernel hang or system crash (denial of service), as the out-of-bounds memory access causes a kernel Oops with PREEMPT SMP PTI enabled. The impact is primarily an availability concern, as the affected system becomes unresponsive. There is no evidence of confidentiality or integrity impact beyond the crash itself, and exploitation appears limited to local contexts where a user can run IGT fbdev tests or trigger similar framebuffer write operations (Feedly).

The Linux kernel maintainers have addressed this vulnerability through patches in the stable kernel tree, referenced by commits 251653fa974ea551a15d16cacfed7cde68cc7f87, c8687694bb1f5c48134f152f8c5c2e53483eb99d, and efd2821b8abeccb6b51423002e2a62921481a26e (Feedly). Users should update to a patched kernel version that includes these fixes. As a workaround, avoiding execution of IGT fbdev tests (particularly the eof subtest) on affected hardware configurations can reduce exposure until a patched kernel is applied.