CVE-2025-71099: drm/xe/oa: Fix potential UAF in xe_oa_add_config_ioctl()
In the Linux kernel, the following vulnerability has been resolved:
drm/xe/oa: Fix potential UAF in xeoaaddconfigioctl()
In xeoaaddconfigioctl(), we accessed oaconfig->id after dropping metricslock. Since this lock protects the lifetime of oaconfig, an attacker could guess the id and call xeoaremoveconfigioctl() with perfect timing, freeing oaconfig before we dereference it, leading to a potential use-after-free.
Fix this by caching the id in a local variable while holding the lock.
v2: (Matt A) - Dropped mutexunlock(&oa->metricslock) ordering change from xeoaremoveconfigioctl()
(cherry picked from commit 28aeaed130e8e587fd1b73b6d66ca41ccc5a1a31)
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-71099?
CVE-2025-71099 has a medium severity rating due to the potential for use-after-free vulnerabilities.
How do I fix CVE-2025-71099?
To address CVE-2025-71099, update to the latest version of the Linux kernel that includes the fix for this vulnerability.
What systems are affected by CVE-2025-71099?
CVE-2025-71099 affects Linux kernel versions that implement the DRM/XE subsystem.
What is the potential impact of CVE-2025-71099?
The potential impact of CVE-2025-71099 is that an attacker could execute arbitrary code or crash the system via a crafted request.
Is there a workaround for CVE-2025-71099?
There are no known workarounds for CVE-2025-71099; the recommended action is to apply the update.