Bug 2420232 (CVE-2023-53806)

Summary: CVE-2023-53806 kernel: drm/amd/display: populate subvp cmd info only for the top pipe
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
An out-of-bounds array access was found in the AMD display driver in the Linux kernel. When populating SubVP command info, the driver incorrectly processes both pipes instead of just the top pipe. This causes an out-of-bounds array access leading to a page fault and system restart when changing to 8K resolution in extended display mode.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2025-12-09 01:01:59 UTC 
In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: populate subvp cmd info only for the top pipe

[Why]
System restart observed while changing the display resolution
to 8k with extended mode. Sytem restart was caused by a page fault.

[How]
When the driver populates subvp info it did it for both the pipes using
vblank which caused an outof bounds array access causing the page fault.
added checks to allow the top pipe only to fix this issue.
Comment 1 Alexander B 2025-12-10 08:52:45 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025120943-CVE-2023-53806-03cb@gregkh/T