CVE-2023-54122: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54122 is a NULL pointer dereference vulnerability in the Linux kernel's Direct Rendering Manager (DRM) subsystem, specifically in the drm/msm/dpu (Qualcomm Display Processing Unit) driver. The flaw arises when kzalloc fails to allocate memory and returns NULL, which is not checked before use in __drm_atomic_helper_crtc_reset. The vulnerability was published on December 24, 2025, and affects Linux kernel versions from 5.3 onward, with patches available in stable releases 5.4.235, 5.10.173, 5.15.99, 6.1.16, 6.2.3, and 6.3. No CVSS score has been formally assigned (base score listed as 0.0), and the EPSS score is approximately 0.024% (Feedly, EUVD).

The root cause is a missing NULL pointer check (CWE-476) following a kzalloc memory allocation call in the drm/msm/dpu driver's CRTC state reset path. When the kernel's memory allocator fails under memory pressure, kzalloc returns NULL, and the subsequent dereference of this NULL pointer in __drm_atomic_helper_crtc_reset triggers a kernel panic. The vulnerability was introduced at commit 1cff7440a86e and is reachable through the display subsystem's atomic state management, which handles display mode transitions. The fix adds an explicit NULL check for cstate before proceeding, as documented in the upstream patchwork entry at https://patchwork.freedesktop.org/patch/514163/ (Feedly).

Successful exploitation of this vulnerability can cause a kernel NULL pointer dereference, resulting in a system crash (kernel panic) and denial of service. The impact is limited to availability — there is no evidence of confidentiality or integrity compromise. Systems running affected Linux kernel versions with Qualcomm Snapdragon SoCs (using the MSM DPU display driver) are at risk, particularly embedded or mobile Linux platforms (Feedly).

Update to a patched Linux kernel version: 5.4.235, 5.10.173, 5.15.99, 6.1.16, 6.2.3, or 6.3 and later. Distribution maintainers (e.g., Red Hat) have tracked this via Bugzilla (Red Hat Bugzilla). As a temporary measure, administrators can monitor for kernel memory allocation failures and ensure systems are not operating under sustained memory pressure. There are no known configuration-based workarounds beyond applying the upstream kernel patch.