CVE-2023-53388: drm/mediatek: Clean dangling pointer on bind error path

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-09-18 · updated 2026-06-17
Weakness: CWE-416

Description

In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Clean dangling pointer on bind error path mtk_drm_bind() can fail, in which case drm_dev_put() is called, destroying the drm_device object. However a pointer to it was still being held in the private object, and that pointer would be passed along to DRM in mtk_drm_sys_prepare() if a suspend were triggered at that point, resulting in a panic. Clean the pointer when destroying the object in the error path to prevent this from happening.

Affected products

Linux kernel: from 4.7 before 4.19.276; from 4.20 before 5.4.235; from 5.5 before 5.10.173; from 5.11 before 5.15.99; from 5.16 before 6.1.16; from 6.2 before 6.2.3 — fixed in 4.19.276, 5.10.173, 5.15.99, 5.4.235, 6.1.16, 6.2.3

How to fix

Upgrade to a fixed version: Linux kernel 4.19.276, 5.10.173, 5.15.99, 5.4.235. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-53388 or the next vulnerability affects your stack