CVE-2023-53678

A NULL pointer dereference was found in the Linux kernel Intel i915 graphics driver's framebuffer device suspend handling. On platforms without display hardware where fbdev is not initialized, a local user with privileges to initiate system suspend can trigger the suspend path, causing the driver to attempt locking a mutex in the uninitialized fbdev structure, which results in a kernel NULL pointer dereference and denial of service through system crash.

The issue arises because the i915 driver's suspend path unconditionally attempts to suspend the framebuffer device without checking whether fbdev was successfully initialized. On platforms lacking display hardware (such as certain server or embedded configurations), fbdev initialization is skipped entirely, leaving the structure NULL. When system suspend is initiated through standard mechanisms (writing to /sys/power/state), the power management subsystem calls into the i915 driver's suspend handler, which then calls intel_fbdev_set_suspend(). This function attempts to acquire a mutex at offset 0x1c8 within the NULL fbdev structure, triggering an immediate kernel NULL pointer dereference. The crash occurs reliably on affected hardware configurations whenever suspend is attempted. While this is a severe availability issue causing complete system failure, exploitation is limited to users with privileges to initiate system suspend operations, and there is no memory corruption or information disclosure beyond the crash itself.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the i915 module from loading. See https://access.redhat.com/solutions/41278 for instructions on blacklisting kernel modules.