CVE-2023-54150: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54150 is an out-of-bounds read/access vulnerability in the Linux kernel's AMD Display Driver BIOS parser (drm/amd). The flaw exists because an array in atomfirmware.h is hardcoded to 8 elements, but some AMD firmware provides a larger array; dereferencing beyond the hardcoded boundary causes an out-of-bounds error. It affects Linux kernel versions prior to the patched releases (5.10.181, 5.15.113, 6.1.30, 6.3.4, and 6.4) and was publicly disclosed on December 24, 2025. The CVSS v3.1 base score is 5.5 (Medium), requiring local low-privileged access with no user interaction (Red Hat CVE, Feedly).

The root cause is an out-of-bounds array access (CWE-125) in the AMD Display BIOS parser within the Linux kernel's DRM subsystem. The array storing firmware-provided data is statically sized to 8 elements in atomfirmware.h, but certain AMD firmware images supply larger arrays; when the kernel attempts to dereference elements beyond index 7, an out-of-bounds memory access occurs. A prior fix (commit 4fc1ba4aa589, "drm/amd/display: fix array index out of bound error in bios parser") addressed some instances of this pattern, but two additional code paths remained unpatched and are addressed by this CVE. Exploitation requires local access with low privileges, as the vulnerable code path is triggered during AMD GPU driver initialization or firmware parsing (Red Hat CVE, EUVD).

Successful exploitation can cause a denial of service (DoS) by crashing or destabilizing the Linux kernel on systems with AMD graphics hardware. The vulnerability has a high availability impact with no confidentiality or integrity impact, meaning an attacker cannot use it to read sensitive data or modify system state — only to disrupt system operation. The scope is limited to the local system, and there is no known potential for lateral movement or data exfiltration (Red Hat CVE, Feedly).

The Linux kernel project has released patches for multiple stable branches. Administrators should update to the following patched versions or later: kernel 5.10.181, 5.15.113, 6.1.30, 6.3.4, or 6.4. The fixes are available via the upstream stable kernel git repository. If immediate patching is not possible, restricting local user access on systems with AMD graphics hardware reduces exposure. Monitoring kernel and driver logs for unusual AMD DRM/display-related errors is also advisable (Red Hat CVE, Red Hat Bugzilla).