CVE-2023-51043 is a high severity (CVSS 7.0) use after free in the Linux kernel's drm_atomic.c, triggered by a race between a nonblocking atomic commit and a driver unload. It affects kernels before 6.4.5. Update to 6.4.5 or later, or a vendor kernel that carries the fix.
What's affected
The NVD description says the Linux kernel before 6.4.5 has a use after free in drivers/gpu/drm/drm_atomic.c, caused by a race condition between a nonblocking atomic commit and a driver unload. The 6.4.5 changelog and a kernel commit are referenced.
As with other kernel CVEs, enterprise distributions backport fixes without changing the base version number. Rely on your vendor's advisory for the package that contains the change.
CVSS for this entry is 7.0 (High) with vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.
How to check if you're exposed
Check the running kernel version and compare it with 6.4.5.
uname -r
Then search your distribution's security tracker for CVE-2023-51043. The NVD vector marks attack complexity as high and requires local access with low privileges, so exposure depends on who can log in and whether graphics drivers can be unloaded by them.
What to do now
- Run uname -r across your Linux fleet and flag kernels older than 6.4.5.
- Look up the fixed package in your distribution's tracker.
- Roll the kernel update out with a reboot window.
- Restrict local access on shared hosts and limit who can load or unload kernel modules.
- Run the free in-browser dependency scan at gold.safeguard.sh/scan against your manifests, and look the entry up in the Safeguard Gold directory to see how it is tracked.
Why it matters
CWE-416 is use after free. Code keeps using a pointer after the memory behind it has been released, so it reads or writes memory that may now belong to something else. Fixes correct the object lifetime so the memory is not touched after release.
The weakness is CWE-416, use after free, arising from a race. Race conditions are harder to hit, which is why the NVD vector lists high attack complexity and a score of 7.0 at the low end of the high band.
The local, low-privilege starting point means this matters most on systems where untrusted users or workloads run, such as shared build hosts and multi-tenant machines.
The record does not mark this CVE as listed in the CISA Known Exploited Vulnerabilities catalog, and no source I read reports exploitation in the wild.
Quick check
Why is the complexity high?
The flaw needs a specific timing between an atomic commit and a driver unload.
Where do I find the fix?
In kernel 6.4.5 upstream, or the matching backport in your distribution's kernel package.
Sources
Last reviewed: 19 October 2026.
