Skip to main content

Boteraser | Website and Server Security Solutions

🛡️ CVE-2023-53455 — kernel

🟡 CVSS 5.5 — Medium ✅ No Known Exploit NVD
5.5
CVSS Score
0 Low4 Medium7 High9 Critical10

Description

drm/vc4: drop all currently held locks if deadlock happens

In the Linux kernel, the following vulnerability has been resolved:

drm/vc4: drop all currently held locks if deadlock happens

If vc4_hdmi_reset_link() returns -EDEADLK, it means that a deadlock

happened in the locking context. This situation should be addressed by

dropping all currently held locks and block until the contended lock

becomes available. Currently, vc4 is not dealing with the deadlock

properly, producing the following output when PROVE_LOCKING is enabled:

[ 825.612809] ------------[ cut here ]------------

[ 825.612852] WARNING: CPU: 1 PID: 116 at drivers/gpu/drm/drm_modeset_lock.c:276 drm_modeset_drop_locks+0x60/0x68 [drm]

[ 825.613458] Modules linked in: 8021q mrp garp stp llc

raspberrypi_cpufreq brcmfmac brcmutil crct10dif_ce hci_uart cfg80211

btqca btbcm bluetooth vc4 raspberrypi_hwmon snd_soc_hdmi_codec cec

clk_raspberrypi ecdh_generic drm_display_helper ecc rfkill

drm_dma_helper drm_kms_helper pwm_bcm2835 bcm2835_thermal bcm2835_rng

rng_core i2c_bcm2835 drm fuse ip_tables x_tables ipv6

[ 825.613735] CPU: 1 PID: 116 Comm: kworker/1:2 Tainted: G W 6.1.0-rc6-01399-g941aae326315 #3

[ 825.613759] Hardware name: Raspberry Pi 3 Model B Rev 1.2 (DT)

[ 825.613777] Workqueue: events output_poll_execute [drm_kms_helper]

[ 825.614038] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)

[ 825.614063] pc : drm_modeset_drop_locks+0x60/0x68 [drm]

[ 825.614603] lr : drm_helper_probe_detect+0x120/0x1b4 [drm_kms_helper]

[ 825.614829] sp : ffff800008313bf0

[ 825.614844] x29: ffff800008313bf0 x28: ffffcd7778b8b000 x27: 0000000000000000

[ 825.614883] x26: 0000000000000001 x25: 0000000000000001 x24: ffff677cc35c2758

[ 825.614920] x23: ffffcd7707d01430 x22: ffffcd7707c3edc7 x21: 0000000000000001

[ 825.614958] x20: 0000000000000000 x19: ffff800008313c10 x18: 000000000000b6d3

[ 825.614995] x17: ffffcd777835e214 x16: ffffcd7777cef870 x15: fffff81000000000

[ 825.615033] x14: 0000000000000000 x13: 0000000000000099 x12: 0000000000000002

[ 825.615070] x11: 72917988020af800 x10: 72917988020af800 x9 : 72917988020af800

[ 825.615108] x8 : ffff677cc665e0a8 x7 : d00a8c180000110c x6 : ffffcd77774c0054

[ 825.615145] x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000000

[ 825.615181] x2 : ffff677cc55e1880 x1 : ffffcd7777cef8ec x0 : ffff800008313c10

[ 825.615219] Call trace:

[ 825.615232] drm_modeset_drop_locks+0x60/0x68 [drm]

[ 825.615773] drm_helper_probe_detect+0x120/0x1b4 [drm_kms_helper]

[ 825.616003] output_poll_execute+0xe4/0x224 [drm_kms_helper]

[ 825.616233] process_one_work+0x2b4/0x618

[ 825.616264] worker_thread+0x24c/0x464

[ 825.616288] kthread+0xec/0x110

[ 825.616310] ret_from_fork+0x10/0x20

[ 825.616335] irq event stamp: 7634

[ 825.616349] hardirqs last enabled at (7633): [<ffffcd777831ee90>] _raw_spin_unlock_irq+0x3c/0x78

[ 825.616384] hardirqs last disabled at (7634): [<ffffcd7778315a78>] __schedule+0x134/0x9f0

[ 825.616411] softirqs last enabled at (7630): [<ffffcd7707aacea0>] local_bh_enable+0x4/0x30 [ipv6]

[ 825.617019] softirqs last disabled at (7618): [<ffffcd7707aace70>] local_bh_disable+0x4/0x30 [ipv6]

[ 825.617586] ---[ end trace 0000000000000000 ]---

Therefore, deal with the deadlock as suggested by [1], using the

function drm_modeset_backoff().

[1] https://docs.kernel.org/gpu/drm-kms.html?highlight=kms#kms-locking

How this vulnerability can be exploited

This issue can be reached with local access to the system, attack complexity is low, an attacker needs low-level privileges on the target. No user interaction is required. The scope is unchanged, so the impact stays within the vulnerable component. Rated impact: confidentiality none, integrity none, availability high.

CVSS metrics in full

The score comes from this vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

  • Attack vector: Local — a local account, shell or session on the host is needed.
  • Attack complexity: Low — the attack works reliably, with no preparation.
  • Privileges required: Low — an ordinary user account is enough.
  • User interaction: None — nobody has to be tricked into anything.
  • Scope: Unchanged — the damage stays inside the vulnerable component.
  • Confidentiality impact: None.
  • Integrity impact: None.
  • Availability impact: High — total loss, or loss the attacker controls.

Affected software

CVE-2023-53455 is recorded against 2 packages.

  • kernel (from 6.2.0 up to 6.2.3)
  • linux-kernel (from 6.2 up to 6.2.3)

Timeline and source

Published on 1 October 2025 and last revised on 12 August 2026. No public exploit is currently recorded for this entry. A vendor advisory or fix has been published. Record sourced from NVD.

References

git.kernel.org (Web)
git.kernel.org (Web)
git.kernel.org (Web)
github.com (Advisory)
nvd.nist.gov (Advisory)
git.kernel.org (Package)

Other advisories for this package

kernel has other advisories on record. If you are patching this one, these are worth checking on the same host:

CVE-2023-53455 on other distributions

Each distribution ships its own build and its own fixed version. Pick the one you run:

Details

Severity Medium
CVSS Score 5.5
CVSS Vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE N/A
Public Exploit ✅ No
Source NVD
Published 2025-10-01
Updated 2026-08-20
Modified 2026-08-12

Affected Packages

Software From version Fixed in
kernel 6.2.0 6.2.3
linux-kernel 6.2 6.2.3

Similar Threats

Vulnerability Monitoring

Track new vulnerabilities in kernel

CVE-2023-53455 is rated CVSS 5.5 Medium. BotEraser monitors your WordPress installation and notifies you when software you use appears in our vulnerability database.

Set Up Free Alerts →

No credit card required  ·  Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.

Browse related advisories

All advisoriesCVECVE 2023
✓