CVE-2023-52921

drm/amdgpu: fix possible UAF in amdgpu_cs_pass1()

7.8 HighFix available

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: fix possible UAF in amdgpu_cs_pass1()

Since the gang_size check is outside of chunk parsing loop, we need to reset i before we free the chunk data.

Suggested by Ye Zhang (@VAR10CK) of Baidu Security.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.23%Up 0.2 points since Nov 19, 2024

What each source reports

CVE List Score used 7.8

drm/amdgpu: fix possible UAF in amdgpu_cs_pass1()

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: fix possible UAF in amdgpu_cs_pass1()

Since the gang_size check is outside of chunk parsing loop, we need to reset i before we free the chunk data.

Suggested by Ye Zhang (@VAR10CK) of Baidu Security.

Record: CVE-2023-52921
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-416
Updated: 2026-11-02

EUVDEUVD-2023-59648 7.8

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: fix possible UAF in amdgpu_cs_pass1()

Since the gang_size check is outside of chunk parsing loop, we need to reset i before we free the chunk data.

Suggested by Ye Zhang (@VAR10CK) of Baidu Security.

Record: EUVD-2023-59648
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-8qh2-vgp4-89x7 7.8

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix possible UAF...

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: fix possible UAF in amdgpu_cs_pass1()

Since the gang_size check is outside of chunk parsing loop, we need to reset i before we free the chunk data.

Suggested by Ye Zhang (@VAR10CK) of Baidu Security.

Record: GHSA-8qh2-vgp4-89x7
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-416
Updated: 2026-11-02

NVD 7.8

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: fix possible UAF in amdgpu_cs_pass1()

Since the gang_size check is outside of chunk parsing loop, we need to reset i before we free the chunk data.

Suggested by Ye Zhang (@VAR10CK) of Baidu Security.

Record: CVE-2023-52921
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-416
Updated: 2026-11-02

OSVAZL-53778 7.8

CVE-2023-52921 affecting package kernel 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: fix possible UAF in amdgpu_cs_pass1()

Since the gang_size check is outside of chunk parsing loop, we need to reset i before we free the chunk data.

Suggested by Ye Zhang (@VAR10CK) of Baidu Security.

Record: AZL-53778
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVBELL-CVE-2023-52921 7.8

Record: BELL-CVE-2023-52921
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 16 moreShow less

OSV 7.8

drm/amdgpu: fix possible UAF in amdgpu_cs_pass1()

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: fix possible UAF in amdgpu_cs_pass1()

Since the gang_size check is outside of chunk parsing loop, we need to reset i before we free the chunk data.

Suggested by Ye Zhang (@VAR10CK) of Baidu Security.

Record: CVE-2023-52921
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2023-52921 7.8

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix possible UAF in amdgpu_cs_pass1() Since the gang_size check is outside of chunk parsing loop, we need to reset i before we free the chunk data. Suggested by Ye Zhang (@VAR10CK) of Baidu Security.

Record: DEBIAN-CVE-2023-52921
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2023-52921 8.5

Record: UBUNTU-CVE-2023-52921
CVSS 4.0: 8.5 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVCLSA-2025-1753298759 No score

kernel: Fix of 18 CVEs

udf: Fix a slab-out-of-bounds write bug in udf_find_entry() {CVE-2022-49846}
Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set {CVE-2022-49136}
Bluetooth: Fix use after free in hci_send_acl {CVE-2022-49111}
NFSv4/pnfs: Fix a use-after-free bug in open {CVE-2022-50072}
NFSv4: Don't hold the layoutget locks across multiple RPC calls {CVE-2022-50072}
ndisc: use RCU protection in ndisc_alloc_skb() {CVE-2025-21764}
cifs: fix double free race when mount fails in cifs_get_root() {CVE-2022-48919}
udmabuf: fix a buf size overflow issue during udmabuf creation {CVE-2025-37803}
um: Fix out-of-bounds read in LDT setup {CVE-2022-49395}
rtw89: cfo: check mac_id to avoid out-of-bounds {CVE-2022-49471}
vsock: Keep the binding until socket destruction {CVE-2025-21756}
net/mlx5: Always stop health timer during driver removal {CVE-2024-40906}
ext4: fix OOB read when checking dotdot dir {CVE-2025-37785}
Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd {CVE-2025-21969}
drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() {CVE-2025-21780}
drm: nv04: Fix out of bounds access {CVE-2024-27008}
parport: Proper fix for array out-of-bounds access {CVE-2024-50074}
sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket {CVE-2024-53168}
net: make sock_inuse_add() available {CVE-2024-53168}
drm/amdgpu: fix possible UAF in amdgpu_cs_pass1() {CVE-2023-52921}

Record: CLSA-2025-1753298759
Updated: 2026-11-02

OSVROOT-OS-UBUNTU-2204-CVE-2023-52921 No score

CVE-2023-52921 in linux - Patched by Root

Root has patched CVE-2023-52921 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.

Record: ROOT-OS-UBUNTU-2204-CVE-2023-52921
Updated: 2026-11-06

OSVSUSE-SU-2024:4314-1 No score