{"id":"CVE-2023-53112","title":"drm/i915/sseu: fix max_subslices array-index-out-of-bounds access","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/sseu: fix max_subslices array-index-out-of-bounds access\n\nIt seems that commit bc3c5e0809ae (\"drm/i915/sseu: Don't try to store EU\nmask internally in UAPI form…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= bc3c5e0809ae9faa039baf75547e8ee46ec124ef < 1a1682abf7399318ac074b1f2ac6a8c992b5b3da","Linux >= bc3c5e0809ae9faa039baf75547e8ee46ec124ef < 36b076ab6247cf0d2135b2ad6bb337617c3b5a1b","Linux >= bc3c5e0809ae9faa039baf75547e8ee46ec124ef < 193c41926d152761764894f46e23b53c00186a82","Linux 6.0"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-05T20:17:34.530575Z"},"published":"2025-05-02","updated":"2026-11-05","sourceUpdated":"2026-11-05T20:21:01.845Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2023-53112","references":[{"url":"https://git.kernel.org/stable/c/1a1682abf7399318ac074b1f2ac6a8c992b5b3da"},{"url":"https://git.kernel.org/stable/c/36b076ab6247cf0d2135b2ad6bb337617c3b5a1b"},{"url":"https://git.kernel.org/stable/c/193c41926d152761764894f46e23b53c00186a82"}],"tags":["cve.org"],"epss":0.00204,"epssPercentile":0.10479,"ingestedAt":"2026-11-05T22:38:31.771Z","slug":"CVE-2023-53112","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/sseu: fix max_subslices array-index-out-of-bounds access\n\nIt seems that commit bc3c5e0809ae (\"drm/i915/sseu: Don't try to store EU\nmask internally in UAPI format\") exposed a potential out-of-bounds\naccess, reported by UBSAN as following on a laptop with a gen 11 i915\ncard:\n\n  UBSAN: array-index-out-of-bounds in drivers/gpu/drm/i915/gt/intel_sseu.c:65:27\n  index 6 is out of range for type 'u16 [6]'\n  CPU: 2 PID: 165 Comm: systemd-udevd Not tainted 6.2.0-9-generic #9-Ubuntu\n  Hardware name: Dell Inc. XPS 13 9300/077Y9N, BIOS 1.11.0 03/22/2022\n  Call Trace:\n   <TASK>\n   show_stack+0x4e/0x61\n   dump_stack_lvl+0x4a/0x6f\n   dump_stack+0x10/0x18\n   ubsan_epilogue+0x9/0x3a\n   __ubsan_handle_out_of_bounds.cold+0x42/0x47\n   gen11_compute_sseu_info+0x121/0x130 [i915]\n   intel_sseu_info_init+0x15d/0x2b0 [i915]\n   intel_gt_init_mmio+0x23/0x40 [i915]\n   i915_driver_mmio_probe+0x129/0x400 [i915]\n   ? intel_gt_probe_all+0x91/0x2e0 [i915]\n   i915_driver_probe+0xe1/0x3f0 [i915]\n   ? drm_privacy_screen_get+0x16d/0x190 [drm]\n   ? acpi_dev_found+0x64/0x80\n   i915_pci_probe+0xac/0x1b0 [i915]\n   ...\n\nAccording to the definition of sseu_dev_info, eu_mask->hsw is limited to\na maximum of GEN_MAX_SS_PER_HSW_SLICE (6) sub-slices, but\ngen11_sseu_info_init() can potentially set 8 sub-slices, in the\n!IS_JSL_EHL(gt->i915) case.\n\nFix this by reserving up to 8 slots for max_subslices in the eu_mask\nstruct.\n\n(cherry picked from commit 3cba09a6ac86ea1d456909626eb2685596c07822)\n\n## Affected\n\n- `Linux >= bc3c5e0809ae9faa039baf75547e8ee46ec124ef < 1a1682abf7399318ac074b1f2ac6a8c992b5b3da`\n- `Linux >= bc3c5e0809ae9faa039baf75547e8ee46ec124ef < 36b076ab6247cf0d2135b2ad6bb337617c3b5a1b`\n- `Linux >= bc3c5e0809ae9faa039baf75547e8ee46ec124ef < 193c41926d152761764894f46e23b53c00186a82`\n- `Linux 6.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}