github - ghsa-6cj4-5m2x-2qj3

ghsa-6cj4-5m2x-2qj3

Vulnerability from github

Published

2025-09-18 18:30

Modified

2025-09-18 18:30

Details

In the Linux kernel, the following vulnerability has been resolved:

drm/ttm: fix bulk_move corruption when adding a entry

When the resource is the first in the bulk_move range, adding it again (thus moving it to the tail) will corrupt the list since the first pointer is not moved. This eventually lead to null pointer deref in ttm_lru_bulk_move_del()

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2023-53444"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-18T16:15:48Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/ttm: fix bulk_move corruption when adding a entry\n\nWhen the resource is the first in the bulk_move range, adding it again\n(thus moving it to the tail) will corrupt the list since the first\npointer is not moved. This eventually lead to null pointer deref in\nttm_lru_bulk_move_del()",
  "id": "GHSA-6cj4-5m2x-2qj3",
  "modified": "2025-09-18T18:30:28Z",
  "published": "2025-09-18T18:30:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-53444"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/4481913607e58196c48a4fef5e6f45350684ec3c"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/70a3015683b007a0db4a1e858791b69afd45fc83"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/e7cf50e41bdc2d574056ebbfeaafc5f0e2562d5b"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

CVE-2023-53444 (GCVE-0-2023-53444)

Vulnerability from cvelistv5

Published

2025-09-18 16:04

Modified

2025-09-18 16:04

Severity ?

Summary

In the Linux kernel, the following vulnerability has been resolved: drm/ttm: fix bulk_move corruption when adding a entry When the resource is the first in the bulk_move range, adding it again (thus moving it to the tail) will corrupt the list since the first pointer is not moved. This eventually lead to null pointer deref in ttm_lru_bulk_move_del()

References

▼	URL	Tags
	https://git.kernel.org/stable/c/70a3015683b007a0db4a1e858791b69afd45fc83
	https://git.kernel.org/stable/c/e7cf50e41bdc2d574056ebbfeaafc5f0e2562d5b
	https://git.kernel.org/stable/c/4481913607e58196c48a4fef5e6f45350684ec3c

Impacted products

Vendor

Product

Version

▼

Linux

Version: fee2ede155423b0f7a559050a39750b98fe9db69
Version: fee2ede155423b0f7a559050a39750b98fe9db69
Version: fee2ede155423b0f7a559050a39750b98fe9db69

Linux

Version: 5.19

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/ttm/ttm_resource.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "70a3015683b007a0db4a1e858791b69afd45fc83",
              "status": "affected",
              "version": "fee2ede155423b0f7a559050a39750b98fe9db69",
              "versionType": "git"
            },
            {
              "lessThan": "e7cf50e41bdc2d574056ebbfeaafc5f0e2562d5b",
              "status": "affected",
              "version": "fee2ede155423b0f7a559050a39750b98fe9db69",
              "versionType": "git"
            },
            {
              "lessThan": "4481913607e58196c48a4fef5e6f45350684ec3c",
              "status": "affected",
              "version": "fee2ede155423b0f7a559050a39750b98fe9db69",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/ttm/ttm_resource.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.19"
            },
            {
              "lessThan": "5.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.4.*",
              "status": "unaffected",
              "version": "6.4.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.5",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.42",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4.7",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.5",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/ttm: fix bulk_move corruption when adding a entry\n\nWhen the resource is the first in the bulk_move range, adding it again\n(thus moving it to the tail) will corrupt the list since the first\npointer is not moved. This eventually lead to null pointer deref in\nttm_lru_bulk_move_del()"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-18T16:04:20.572Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/70a3015683b007a0db4a1e858791b69afd45fc83"
        },
        {
          "url": "https://git.kernel.org/stable/c/e7cf50e41bdc2d574056ebbfeaafc5f0e2562d5b"
        },
        {
          "url": "https://git.kernel.org/stable/c/4481913607e58196c48a4fef5e6f45350684ec3c"
        }
      ],
      "title": "drm/ttm: fix bulk_move corruption when adding a entry",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53444",
    "datePublished": "2025-09-18T16:04:20.572Z",
    "dateReserved": "2025-09-17T14:54:09.752Z",
    "dateUpdated": "2025-09-18T16:04:20.572Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted