CVE-2023-3355: Null pointer dereference in submit_lookup_cmds() in drivers/gpu/drm/msm/msm_gem_submit.c

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-06-28 · updated 2026-06-17
Weakness: CWE-476

Description

A NULL pointer dereference flaw was found in the Linux kernel's drivers/gpu/drm/msm/msm_gem_submit.c code in the submit_lookup_cmds function, which fails because it lacks a check of the return value of kmalloc(). This issue allows a local user to crash the system.

Affected products

Linux kernel: before 6.1; 6.1, 6.1-rc1, 6.1-rc2, 6.1-rc3, 6.1-rc4, 6.1-rc5 (+2) — fixed in 6.1

How to fix

Upgrade to a fixed version: Linux kernel 6.1. Check the vendor advisory for mitigations.

References

https://access.redhat.com/security/cve/CVE-2023-3355
https://bugzilla.redhat.com/show_bug.cgi?id=2217820
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d839f0811a31322c087a859c2b181e2383daa7be
https://access.redhat.com/security/cve/CVE-2023-3355
https://bugzilla.redhat.com/show_bug.cgi?id=2217820
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d839f0811a31322c087a859c2b181e2383daa7be

Get alerted when CVE-2023-3355 or the next vulnerability affects your stack