Riskcovery

CVE-2023-54202

drm/i915: fix race condition UAF in i915_perf_add_config_ioctl

State
Published
Severity
7.8 High
Published
Dec 30, 2025
Updated
Oct 15, 2026
Reserved
Dec 30, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/i915: fix race condition UAF in i915_perf_add_config_ioctl

Userspace can guess the id value and try to race oa_config object creation with config remove, resulting in a use-after-free if we dereference the object after unlocking the metrics_lock. For that reason, unlocking the metrics_lock must be done after we are done dereferencing the object.

[tursulin: Manually added stable tag.] (cherry picked from commit 49f6f6483b652108bcb73accd0204a464b922395)

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • f89823c212246d0671cc51e69894a3df1a743aee to before 6eeb1cba4c9dc47656ea328afa34953c28783d8cAffected
  • f89823c212246d0671cc51e69894a3df1a743aee to before 240b1502708858b5e3f10b6dc5ca3f148a322fefAffected
  • f89823c212246d0671cc51e69894a3df1a743aee to before 7eb98f5ac551863efe8be810cea1cd5411d677b1Affected
  • f89823c212246d0671cc51e69894a3df1a743aee to before dc30c011469165d57af9adac5baff7d767d20e5cAffected
LinuxLinux
  • 4.14Affected
  • before 4.14Not affected
  • 5.15.108 through 5.15.*Not affected
  • 6.1.24 through 6.1.*Not affected
  • 6.2.11 through 6.2.*Not affected
  • 6.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.