GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2023-54254 (GCVE-0-2023-54254)

Vulnerability from cvelistv5 – Published: 2025-12-30 12:15 – Updated: 2026-08-05 09:18
VLAI
Title
drm/ttm: Don't leak a resource on eviction error
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/ttm: Don't leak a resource on eviction error On eviction errors other than -EMULTIHOP we were leaking a resource. Fix. v2: - Avoid yet another goto (Andi Shyti)
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 403797925768d9fa870f5b1ebcd20016b397083b , < 7738335d73d0686ec8995e0448e5d1b48cffb2a4 (git)
Affected: 403797925768d9fa870f5b1ebcd20016b397083b , < e9c44738cb1f537b177cc1beabcf6913690460cd (git)
Affected: 403797925768d9fa870f5b1ebcd20016b397083b , < 6aea0032380bbb1efebd598ad733d16925167921 (git)
Affected: 403797925768d9fa870f5b1ebcd20016b397083b , < e8188c461ee015ba0b9ab2fc82dbd5ebca5a5532 (git)
Affected: 6c68fbafb9cd13e13476043fd9f6e10f792f685a (git)
Affected: 5.14.6 , < 5.15 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 5.15
Unaffected: 0 , < 5.15 (semver)
Unaffected: 5.15.124 , ≤ 5.15.* (semver)
Unaffected: 6.1.43 , ≤ 6.1.* (semver)
Unaffected: 6.4.5 , ≤ 6.4.* (semver)
Unaffected: 6.5 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/ttm/ttm_bo.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7738335d73d0686ec8995e0448e5d1b48cffb2a4",
              "status": "affected",
              "version": "403797925768d9fa870f5b1ebcd20016b397083b",
              "versionType": "git"
            },
            {
              "lessThan": "e9c44738cb1f537b177cc1beabcf6913690460cd",
              "status": "affected",
              "version": "403797925768d9fa870f5b1ebcd20016b397083b",
              "versionType": "git"
            },
            {
              "lessThan": "6aea0032380bbb1efebd598ad733d16925167921",
              "status": "affected",
              "version": "403797925768d9fa870f5b1ebcd20016b397083b",
              "versionType": "git"
            },
            {
              "lessThan": "e8188c461ee015ba0b9ab2fc82dbd5ebca5a5532",
              "status": "affected",
              "version": "403797925768d9fa870f5b1ebcd20016b397083b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "6c68fbafb9cd13e13476043fd9f6e10f792f685a",
              "versionType": "git"
            },
            {
              "lessThan": "5.15",
              "status": "affected",
              "version": "5.14.6",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/ttm/ttm_bo.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.124",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.43",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.4.*",
              "status": "unaffected",
              "version": "6.4.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.5",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.124",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.43",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4.5",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.5",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.14.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/ttm: Don\u0027t leak a resource on eviction error\n\nOn eviction errors other than -EMULTIHOP we were leaking a resource.\nFix.\n\nv2:\n- Avoid yet another goto (Andi Shyti)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached only through DRM ioctls (GEM create / command submission / buffer validation) on a local device node such as /dev/dri/renderD128. There is no network-facing consumer of ttm_bo_evict().\nAC:L - The attacker controls both preconditions: it fills VRAM/GTT with its own BOs to force the eviction path, then delivers a signal to its own ioctl thread so the interruptible wait inside the driver move callback returns -ERESTARTSYS, a non-EMULTIHOP error that leaks the resource. This is deterministic and can be repeated in a tight loop.\nPR:L - An ordinary unprivileged local user needs only an open FD on a DRM render node, which is granted to the render/video group on desktops, to every GPU-using app on Android and ChromeOS, and to containers with GPU passthrough. No capability or root access is involved.\nUI:N - The attacking process drives allocation, eviction and signal delivery entirely on its own. No action by any other user is required.\nS:U - The leaked resource, the dangling res-\u003ebo pointer, and all subsequent corruption remain within the kernel\u0027s own security authority. No hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - The orphaned ttm_resource retains a dangling res-\u003ebo to a freed ttm_buffer_object that later LRU walkers dereference without any validity check, giving a use-after-free whose freed-object contents the attacker can groom via heap spray to read kernel memory through the bo-\u003ebase.resv / bo-\u003ebdev / bo-\u003eresource pointer chains.\nI:H - The same use-after-free yields write and control-flow primitives: ttm_bo_evict_swapout_allowable() calls dma_resv_trylock() through an attacker-controlled bo-\u003ebase.resv pointer and indirect-calls bo-\u003ebdev-\u003efuncs-\u003eeviction_valuable() read from reclaimed slab memory.\nA:H - Each triggered error permanently leaks a VRAM/GTT range and an LRU entry, so repeated invocation exhausts GPU memory device-wide and denies service to all users including the display server; additionally the never-empty LRU makes ttm_resource_manager_evict_all() spin forever at suspend/unload, and the use-after-free crashes the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:18:27.491Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7738335d73d0686ec8995e0448e5d1b48cffb2a4"
        },
        {
          "url": "https://git.kernel.org/stable/c/e9c44738cb1f537b177cc1beabcf6913690460cd"
        },
        {
          "url": "https://git.kernel.org/stable/c/6aea0032380bbb1efebd598ad733d16925167921"
        },
        {
          "url": "https://git.kernel.org/stable/c/e8188c461ee015ba0b9ab2fc82dbd5ebca5a5532"
        }
      ],
      "title": "drm/ttm: Don\u0027t leak a resource on eviction error",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-54254",
    "datePublished": "2025-12-30T12:15:50.163Z",
    "dateReserved": "2025-12-30T12:06:44.515Z",
    "dateUpdated": "2026-08-05T09:18:27.491Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-54254",
      "date": "2026-09-16",
      "epss": "0.00149",
      "percentile": "0.04494"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-54254\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-30T13:16:14.107\",\"lastModified\":\"2026-08-04T11:16:38.357\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/ttm: Don\u0027t leak a resource on eviction error\\n\\nOn eviction errors other than -EMULTIHOP we were leaking a resource.\\nFix.\\n\\nv2:\\n- Avoid yet another goto (Andi Shyti)\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\\n\\ndrm/ttm: No filtrar un recurso en error de desalojo\\n\\nEn errores de desalojo distintos de -EMULTIHOP, se estaba filtrando un recurso.\\nSoluci\u00f3n.\\n\\nv2:\\n- Evitar otro \u0027goto\u0027 m\u00e1s (Andi Shyti)\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/ttm/ttm_bo.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"403797925768d9fa870f5b1ebcd20016b397083b\",\"lessThan\":\"7738335d73d0686ec8995e0448e5d1b48cffb2a4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"403797925768d9fa870f5b1ebcd20016b397083b\",\"lessThan\":\"e9c44738cb1f537b177cc1beabcf6913690460cd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"403797925768d9fa870f5b1ebcd20016b397083b\",\"lessThan\":\"6aea0032380bbb1efebd598ad733d16925167921\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"403797925768d9fa870f5b1ebcd20016b397083b\",\"lessThan\":\"e8188c461ee015ba0b9ab2fc82dbd5ebca5a5532\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6c68fbafb9cd13e13476043fd9f6e10f792f685a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.14.6\",\"lessThan\":\"5.15\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/ttm/ttm_bo.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.124\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.43\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.4.5\",\"lessThanOrEqual\":\"6.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.5\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/6aea0032380bbb1efebd598ad733d16925167921\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7738335d73d0686ec8995e0448e5d1b48cffb2a4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e8188c461ee015ba0b9ab2fc82dbd5ebca5a5532\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e9c44738cb1f537b177cc1beabcf6913690460cd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:52:56+00:00",
      "cve": "CVE-2023-54254",
      "id": "CVE-2023-54254",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:fixed": "279",
      "product_status:known_affected": "70",
      "product_status:known_not_affected": "118",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Kernel: Denial of Service via resource leak in drm/ttm",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-54254.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-02T01:40:28Z",
      "cve": "CVE-2023-54254",
      "id": "CVE-2023-54254",
      "initial_release_date": "2025-12-31T00:27:25Z",
      "product_status:known_affected": "435",
      "product_status:known_not_affected": "295",
      "product_status:recommended": "328",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-54254",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-54254.json",
      "version": "36"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.