---
id: CVE-2023-53077
title: 'drm/amd/display: fix shift-out-of-bounds in CalculateVMAndRowBytes'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/amd/display: fix shift-out-of-bounds in CalculateVMAndRowBytes

  [WHY]
  When PTEBufferSizeInRequests is zero, UBSAN reports the following
  warning because dml_log2 ret…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 6725a88f88a7e922e91c45bf83d320487810c192 <
    7257070be70e19a9138f39009c1a26c83a8a7cfa
  - >-
    Linux >= 6725a88f88a7e922e91c45bf83d320487810c192 <
    bec1bea2fa974e63f6059c33edde669c7894d0bc
  - >-
    Linux >= 6725a88f88a7e922e91c45bf83d320487810c192 <
    a16394b5d661afec9a264fecac3abd87aea439ea
  - >-
    Linux >= 6725a88f88a7e922e91c45bf83d320487810c192 <
    e12b95680821b9880cd9992c0f3555389363604f
  - >-
    Linux >= 6725a88f88a7e922e91c45bf83d320487810c192 <
    031f196d1b1b6d5dfcb0533b431e3ab1750e6189
  - Linux 5.9
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T20:16:33.876863Z'
published: '2025-05-02'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T20:20:59.137Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2023-53077'
references:
  - url: 'https://git.kernel.org/stable/c/7257070be70e19a9138f39009c1a26c83a8a7cfa'
  - url: 'https://git.kernel.org/stable/c/bec1bea2fa974e63f6059c33edde669c7894d0bc'
  - url: 'https://git.kernel.org/stable/c/a16394b5d661afec9a264fecac3abd87aea439ea'
  - url: 'https://git.kernel.org/stable/c/e12b95680821b9880cd9992c0f3555389363604f'
  - url: 'https://git.kernel.org/stable/c/031f196d1b1b6d5dfcb0533b431e3ab1750e6189'
tags:
  - cve.org
epss: 0.00212
epssPercentile: 0.11574
ingestedAt: '2026-11-05T22:38:31.765Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: fix shift-out-of-bounds in CalculateVMAndRowBytes

[WHY]
When PTEBufferSizeInRequests is zero, UBSAN reports the following
warning because dml_log2 returns an unexpected negative value:

  shift exponent 4294966273 is too large for 32-bit type 'int'

[HOW]

In the case PTEBufferSizeInRequests is zero, skip the dml_log2() and
assign the result directly.

## Affected

- `Linux >= 6725a88f88a7e922e91c45bf83d320487810c192 < 7257070be70e19a9138f39009c1a26c83a8a7cfa`
- `Linux >= 6725a88f88a7e922e91c45bf83d320487810c192 < bec1bea2fa974e63f6059c33edde669c7894d0bc`
- `Linux >= 6725a88f88a7e922e91c45bf83d320487810c192 < a16394b5d661afec9a264fecac3abd87aea439ea`
- `Linux >= 6725a88f88a7e922e91c45bf83d320487810c192 < e12b95680821b9880cd9992c0f3555389363604f`
- `Linux >= 6725a88f88a7e922e91c45bf83d320487810c192 < 031f196d1b1b6d5dfcb0533b431e3ab1750e6189`
- `Linux 5.9`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.