{"id":"DEBIAN-CVE-2023-53351","details":"In the Linux kernel, the following vulnerability has been resolved:  drm/sched: Check scheduler work queue before calling timeout handling  During an IGT GPU reset test we see again oops despite of commit 0c8c901aaaebc9 (drm/sched: Check scheduler ready before calling timeout handling).  It uses ready condition whether to call drm_sched_fault which unwind the TDR leads to GPU reset. However it looks the ready condition is overloaded with other meanings, for example, for the following stack is related GPU reset :  0  gfx_v9_0_cp_gfx_start 1  gfx_v9_0_cp_gfx_resume 2  gfx_v9_0_cp_resume 3  gfx_v9_0_hw_init 4  gfx_v9_0_resume 5  amdgpu_device_ip_resume_phase2  does the following: \t/* start the ring */ \tgfx_v9_0_cp_gfx_start(adev); \tring-\u003esched.ready = true;  The same approach is for other ASICs as well : gfx_v8_0_cp_gfx_resume gfx_v10_0_kiq_resume, etc...  As a result, our GPU reset test causes GPU fault which calls unconditionally gfx_v9_0_fault and then drm_sched_fault. However now it depends on whether the interrupt service routine drm_sched_fault is executed after gfx_v9_0_cp_gfx_start is completed which sets the ready field of the scheduler to true even  for uninitialized schedulers and causes oops vs no fault or when ISR  drm_sched_fault is completed prior  gfx_v9_0_cp_gfx_start and NULL pointer dereference does not occur.  Use the field timeout_wq  to prevent oops for uninitialized schedulers. The field could be initialized by the work queue of resetting the domain.  v1: Corrections to commit message (Luben)","modified":"2026-09-15T09:02:50.947384409Z","published":"2025-09-17T15:15:39.057Z","upstream":["CVE-2023-53351"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2023-53351"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.7-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2023-53351.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.7-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2023-53351.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}