GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2023-52586 (GCVE-0-2023-52586)

Vulnerability from cvelistv5 – Published: 2024-03-06 06:45 – Updated: 2026-08-05 09:10
VLAI
Title
drm/msm/dpu: Add mutex lock in control vblank irq
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/msm/dpu: Add mutex lock in control vblank irq Add a mutex lock to control vblank irq to synchronize vblank enable/disable operations happening from different threads to prevent race conditions while registering/unregistering the vblank irq callback. v4: -Removed vblank_ctl_lock from dpu_encoder_virt, so it is only a parameter of dpu_encoder_phys. -Switch from atomic refcnt to a simple int counter as mutex has now been added v3: Mistakenly did not change wording in last version. It is done now. v2: Slightly changed wording of commit message Patchwork: https://patchwork.freedesktop.org/patch/571854/
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 15:56 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 25fdd5933e4c0f5fe2ea5cd59994f8ac5fbe90ef , < 14f109bf74dd67e1d0469fed859c8e506b0df53f (git)
Affected: 25fdd5933e4c0f5fe2ea5cd59994f8ac5fbe90ef , < 45284ff733e4caf6c118aae5131eb7e7cf3eea5a (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.19
Unaffected: 0 , < 4.19 (semver)
Unaffected: 6.7.4 , ≤ 6.7.* (semver)
Unaffected: 6.8 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T23:03:21.270Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/14f109bf74dd67e1d0469fed859c8e506b0df53f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/45284ff733e4caf6c118aae5131eb7e7cf3eea5a"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-52586",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:56:01.645809Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:32.350Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c",
            "drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h",
            "drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c",
            "drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "14f109bf74dd67e1d0469fed859c8e506b0df53f",
              "status": "affected",
              "version": "25fdd5933e4c0f5fe2ea5cd59994f8ac5fbe90ef",
              "versionType": "git"
            },
            {
              "lessThan": "45284ff733e4caf6c118aae5131eb7e7cf3eea5a",
              "status": "affected",
              "version": "25fdd5933e4c0f5fe2ea5cd59994f8ac5fbe90ef",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c",
            "drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h",
            "drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c",
            "drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.19"
            },
            {
              "lessThan": "4.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.4",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm/dpu: Add mutex lock in control vblank irq\n\nAdd a mutex lock to control vblank irq to synchronize vblank\nenable/disable operations happening from different threads to prevent\nrace conditions while registering/unregistering the vblank irq callback.\n\nv4: -Removed vblank_ctl_lock from dpu_encoder_virt, so it is only a\n    parameter of dpu_encoder_phys.\n    -Switch from atomic refcnt to a simple int counter as mutex has\n    now been added\nv3: Mistakenly did not change wording in last version. It is done now.\nv2: Slightly changed wording of commit message\n\nPatchwork: https://patchwork.freedesktop.org/patch/571854/"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached through local DRM primary-node ioctls (DRM_IOCTL_WAIT_VBLANK / CRTC sequence and modeset/kickoff paths) into dpu_encoder_*_control_vblank_irq on Qualcomm MSM DPU hardware; there is no network or adjacent-protocol reachability.\nAC:L - An attacker who can open the DRM card node can drive both sides of the race\u2014concurrent WAIT_VBLANK enable/disable (queued via msm vblank work) and irq_control from atomic kickoff/idle-PC/stop\u2014so success does not depend on conditions outside attacker control.\nPR:L - WAIT_VBLANK and related sequence ioctls require only an open /dev/dri/cardN fd (no DRM_AUTH/MASTER/CAP_SYS_ADMIN), and DRM master for the modeset side is granted to the session/video-group user via logind without real root.\nUI:N - The attacker triggers both vblank and resource-control paths entirely through their own DRM ioctls and threads; no separate victim action is required.\nS:U - Impact remains within the host kernel\u2019s security authority; this is a standard kernel race/UAF, not a VM escape, IOMMU bypass, or other cross-boundary scope change.\nC:H - The race can leave a vblank IRQ callback registered with phys_enc after refcount hits zero and the encoder is later freed (destroy only kfree\u2019s phys without guaranteed unregister), yielding a use-after-free read of attacker-reclaimable heap via the IRQ handler.\nI:H - The same dangling IRQ callback UAF on phys_enc is heap-sprayable and provides a write/control-flow hijack primitive once the freed object is reused, consistent with scoring use-after-free as High integrity impact.\nA:H - Mismatched register/unregister also hits WARN_ON on double-register, NULL/stale dereferences in the IRQ callback, and kernel oops/panic on the dangling phys_enc path, fully disrupting availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:10:29.188Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/14f109bf74dd67e1d0469fed859c8e506b0df53f"
        },
        {
          "url": "https://git.kernel.org/stable/c/45284ff733e4caf6c118aae5131eb7e7cf3eea5a"
        }
      ],
      "title": "drm/msm/dpu: Add mutex lock in control vblank irq",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-52586",
    "datePublished": "2024-03-06T06:45:20.913Z",
    "dateReserved": "2024-03-02T21:55:42.570Z",
    "dateUpdated": "2026-08-05T09:10:29.188Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-52586",
      "date": "2026-09-19",
      "epss": "0.00161",
      "percentile": "0.05719"
    },
    "fkie_nvd": {
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm/dpu: Add mutex lock in control vblank irq\n\nAdd a mutex lock to control vblank irq to synchronize vblank\nenable/disable operations happening from different threads to prevent\nrace conditions while registering/unregistering the vblank irq callback.\n\nv4: -Removed vblank_ctl_lock from dpu_encoder_virt, so it is only a\n    parameter of dpu_encoder_phys.\n    -Switch from atomic refcnt to a simple int counter as mutex has\n    now been added\nv3: Mistakenly did not change wording in last version. It is done now.\nv2: Slightly changed wording of commit message\n\nPatchwork: https://patchwork.freedesktop.org/patch/571854/"
        },
        {
          "lang": "es",
          "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/msm/dpu: agregue un bloqueo mutex en el control vblank irq. Agregue un bloqueo mutex para controlar vblank irq para sincronizar las operaciones de activaci\u00f3n/desactivaci\u00f3n de vblank que ocurren desde diferentes subprocesos para evitar condiciones de ejecuci\u00f3n durante el registro. /anular el registro de la devoluci\u00f3n de llamada vblank irq. v4: -Se elimin\u00f3 vblank_ctl_lock de dpu_encoder_virt, por lo que es solo un par\u00e1metro de dpu_encoder_phys. -Cambiar de refcnt at\u00f3mico a un contador int simple ya que ahora se ha agregado mutex v3: por error no cambi\u00f3 la redacci\u00f3n en la \u00faltima versi\u00f3n. Ya est\u00e1 hecho. v2: redacci\u00f3n ligeramente modificada del mensaje de confirmaci\u00f3n Patchwork: https://patchwork.freedesktop.org/patch/571854/"
        }
      ],
      "id": "CVE-2023-52586",
      "lastModified": "2024-11-21T08:40:07.803",
      "published": "2024-03-06T07:15:07.443",
      "references": [
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/14f109bf74dd67e1d0469fed859c8e506b0df53f"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/45284ff733e4caf6c118aae5131eb7e7cf3eea5a"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/14f109bf74dd67e1d0469fed859c8e506b0df53f"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/45284ff733e4caf6c118aae5131eb7e7cf3eea5a"
        }
      ],
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-10T14:55:47.000Z",
      "cve": "CVE-2023-52586",
      "id": "msrc_CVE-2023-52586",
      "initial_release_date": "2025-09-03T21:56:10.000Z",
      "product_status:known_affected": "23",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "drm/msm/dpu: Add mutex lock in control vblank irq",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2023-52586.json",
      "version": "18"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c",
                  "drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h",
                  "drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c",
                  "drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "14f109bf74dd67e1d0469fed859c8e506b0df53f",
                    "status": "affected",
                    "version": "25fdd5933e4c0f5fe2ea5cd59994f8ac5fbe90ef",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "45284ff733e4caf6c118aae5131eb7e7cf3eea5a",
                    "status": "affected",
                    "version": "25fdd5933e4c0f5fe2ea5cd59994f8ac5fbe90ef",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c",
                  "drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h",
                  "drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c",
                  "drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.19"
                  },
                  {
                    "lessThan": "4.19",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.7.*",
                    "status": "unaffected",
                    "version": "6.7.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.8",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "700BC119-5E42-40C5-98D6-59BFBDFAB9A9",
                    "versionEndExcluding": "6.7.4",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm/dpu: Add mutex lock in control vblank irq\n\nAdd a mutex lock to control vblank irq to synchronize vblank\nenable/disable operations happening from different threads to prevent\nrace conditions while registering/unregistering the vblank irq callback.\n\nv4: -Removed vblank_ctl_lock from dpu_encoder_virt, so it is only a\n    parameter of dpu_encoder_phys.\n    -Switch from atomic refcnt to a simple int counter as mutex has\n    now been added\nv3: Mistakenly did not change wording in last version. It is done now.\nv2: Slightly changed wording of commit message\n\nPatchwork: https://patchwork.freedesktop.org/patch/571854/"
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/msm/dpu: agregue un bloqueo mutex en el control vblank irq. Agregue un bloqueo mutex para controlar vblank irq para sincronizar las operaciones de activaci\u00f3n/desactivaci\u00f3n de vblank que ocurren desde diferentes subprocesos para evitar condiciones de ejecuci\u00f3n durante el registro. /anular el registro de la devoluci\u00f3n de llamada vblank irq. v4: -Se elimin\u00f3 vblank_ctl_lock de dpu_encoder_virt, por lo que es solo un par\u00e1metro de dpu_encoder_phys. -Cambiar de refcnt at\u00f3mico a un contador int simple ya que ahora se ha agregado mutex v3: por error no cambi\u00f3 la redacci\u00f3n en la \u00faltima versi\u00f3n. Ya est\u00e1 hecho. v2: redacci\u00f3n ligeramente modificada del mensaje de confirmaci\u00f3n Patchwork: https://patchwork.freedesktop.org/patch/571854/"
          }
        ],
        "id": "CVE-2023-52586",
        "lastModified": "2026-08-04T10:18:32.667",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.0,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.0,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2023-52586",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:56:01.645809Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-03-06T07:15:07.443",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Mailing List",
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/14f109bf74dd67e1d0469fed859c8e506b0df53f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Mailing List",
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/45284ff733e4caf6c118aae5131eb7e7cf3eea5a"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mailing List",
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/14f109bf74dd67e1d0469fed859c8e506b0df53f"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mailing List",
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/45284ff733e4caf6c118aae5131eb7e7cf3eea5a"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-362"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:26:15+00:00",
      "cve": "CVE-2023-52586",
      "id": "CVE-2023-52586",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/msm/dpu: Add mutex lock in control vblank irq",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-52586.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-05T00:50:25Z",
      "cve": "CVE-2023-52586",
      "id": "CVE-2023-52586",
      "initial_release_date": "2024-03-07T04:25:40Z",
      "product_status:known_affected": "396",
      "product_status:known_not_affected": "298",
      "product_status:recommended": "506",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-52586",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-52586.json",
      "version": "58"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-02T23:03:21.270Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/14f109bf74dd67e1d0469fed859c8e506b0df53f"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/45284ff733e4caf6c118aae5131eb7e7cf3eea5a"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2023-52586",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-09-10T15:56:01.645809Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-09-11T12:42:17.206Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c",
                "drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h",
                "drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c",
                "drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "14f109bf74dd67e1d0469fed859c8e506b0df53f",
                  "status": "affected",
                  "version": "25fdd5933e4c0f5fe2ea5cd59994f8ac5fbe90ef",
                  "versionType": "git"
                },
                {
                  "lessThan": "45284ff733e4caf6c118aae5131eb7e7cf3eea5a",
                  "status": "affected",
                  "version": "25fdd5933e4c0f5fe2ea5cd59994f8ac5fbe90ef",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c",
                "drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h",
                "drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c",
                "drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "4.19"
                },
                {
                  "lessThan": "4.19",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.7.*",
                  "status": "unaffected",
                  "version": "6.7.4",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.8",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.7.4",
                      "versionStartIncluding": "4.19",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.8",
                      "versionStartIncluding": "4.19",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm/dpu: Add mutex lock in control vblank irq\n\nAdd a mutex lock to control vblank irq to synchronize vblank\nenable/disable operations happening from different threads to prevent\nrace conditions while registering/unregistering the vblank irq callback.\n\nv4: -Removed vblank_ctl_lock from dpu_encoder_virt, so it is only a\n    parameter of dpu_encoder_phys.\n    -Switch from atomic refcnt to a simple int counter as mutex has\n    now been added\nv3: Mistakenly did not change wording in last version. It is done now.\nv2: Slightly changed wording of commit message\n\nPatchwork: https://patchwork.freedesktop.org/patch/571854/"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:L - The bug is reached through local DRM primary-node ioctls (DRM_IOCTL_WAIT_VBLANK / CRTC sequence and modeset/kickoff paths) into dpu_encoder_*_control_vblank_irq on Qualcomm MSM DPU hardware; there is no network or adjacent-protocol reachability.\nAC:L - An attacker who can open the DRM card node can drive both sides of the race\u2014concurrent WAIT_VBLANK enable/disable (queued via msm vblank work) and irq_control from atomic kickoff/idle-PC/stop\u2014so success does not depend on conditions outside attacker control.\nPR:L - WAIT_VBLANK and related sequence ioctls require only an open /dev/dri/cardN fd (no DRM_AUTH/MASTER/CAP_SYS_ADMIN), and DRM master for the modeset side is granted to the session/video-group user via logind without real root.\nUI:N - The attacker triggers both vblank and resource-control paths entirely through their own DRM ioctls and threads; no separate victim action is required.\nS:U - Impact remains within the host kernel\u2019s security authority; this is a standard kernel race/UAF, not a VM escape, IOMMU bypass, or other cross-boundary scope change.\nC:H - The race can leave a vblank IRQ callback registered with phys_enc after refcount hits zero and the encoder is later freed (destroy only kfree\u2019s phys without guaranteed unregister), yielding a use-after-free read of attacker-reclaimable heap via the IRQ handler.\nI:H - The same dangling IRQ callback UAF on phys_enc is heap-sprayable and provides a write/control-flow hijack primitive once the freed object is reused, consistent with scoring use-after-free as High integrity impact.\nA:H - Mismatched register/unregister also hits WARN_ON on double-register, NULL/stale dereferences in the IRQ callback, and kernel oops/panic on the dangling phys_enc path, fully disrupting availability."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T09:10:29.188Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/14f109bf74dd67e1d0469fed859c8e506b0df53f"
            },
            {
              "url": "https://git.kernel.org/stable/c/45284ff733e4caf6c118aae5131eb7e7cf3eea5a"
            }
          ],
          "title": "drm/msm/dpu: Add mutex lock in control vblank irq",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2023-52586",
        "datePublished": "2024-03-06T06:45:20.913Z",
        "dateReserved": "2024-03-02T21:55:42.570Z",
        "dateUpdated": "2026-08-05T09:10:29.188Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.