CVE-2023-53288: drm/client: Fix memory leak in drm_client_modeset_probe

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-09-16 · updated 2026-06-17
Weakness: CWE-401

Description

In the Linux kernel, the following vulnerability has been resolved: drm/client: Fix memory leak in drm_client_modeset_probe When a new mode is set to modeset->mode, the previous mode should be freed. This fixes the following kmemleak report: drm_mode_duplicate+0x45/0x220 [drm] drm_client_modeset_probe+0x944/0xf50 [drm] __drm_fb_helper_initial_config_and_unlock+0xb4/0x2c0 [drm_kms_helper] drm_fbdev_client_hotplug+0x2bc/0x4d0 [drm_kms_helper] drm_client_register+0x169/0x240 [drm] ast_pci_probe+0x142/0x190 [ast] local_pci_probe+0xdc/0x180 work_for_cpu_fn+0x4e/0xa0 process_one_work+0x8b7/0x1540 worker_thread+0x70a/0xed0 kthread+0x29f/0x340 ret_from_fork+0x1f/0x30

Affected products

Linux kernel: before 5.4.251; from 5.5 before 5.10.188; from 5.11 before 5.15.123; from 5.16 before 6.1.42; from 6.2 before 6.4.7; 6.5-rc1, 6.5-rc2 — fixed in 5.10.188, 5.15.123, 5.4.251, 6.1.42, 6.4.7

How to fix

Upgrade to a fixed version: Linux kernel 5.10.188, 5.15.123, 5.4.251, 6.1.42. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-53288 or the next vulnerability affects your stack