{"id":"CVE-2025-71099","revision":"5c8c252c87ef49bc8c1e67000f748586","records":[{"revision":"5c8c252c87ef49bc8c1e67000f748586","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-71099","aliases":[],"title":"drm/xe/oa: Fix potential UAF in xe_oa_add_config_ioctl()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/oa: Fix potential UAF in xe_oa_add_config_ioctl()\n\nIn xe_oa_add_config_ioctl(), we accessed oa_config->id after dropping\nmetrics_lock. Since this lock protects the lifetime of oa_config, an\nattacker could guess the id and call xe_oa_remove_config_ioctl() with\nperfect timing, freeing oa_config before we dereference it, leading to\na potential use-after-free.\n\nFix this by caching the id in a local variable while holding the lock.\n\nv2: (Matt A)\n- Dropped mutex_unlock(&oa->metrics_lock) ordering change from\n  xe_oa_remove_config_ioctl()\n\n(cherry picked from commit 28aeaed130e8e587fd1b73b6d66ca41ccc5a1a31)","state":0,"publishedAt":"2026-01-13T15:34:58.359+00:00","modifiedAt":"2026-10-19T18:15:13.054+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/gpu/drm/xe/xe_oa.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"cdf02fe1a94a768cbcd20f5c4e1a1d805f4a06c0\",\n                            \"lessThan\": \"c6d30b65b7a44dac52ad49513268adbf19eab4a2\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"cdf02fe1a94a768cbcd20f5c4e1a1d805f4a06c0\",\n                            \"lessThan\": \"7cdb9a9da935c687563cc682155461fef5f9b48d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"cdf02fe1a94a768cbcd20f5c4e1a1d805f4a06c0\",\n                            \"lessThan\": \"dcb171931954c51a1a7250d558f02b8f36570783\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/gpu/drm/xe/xe_oa.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.11\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.11\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.64\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.4\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.19\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/c6d30b65b7a44dac52ad49513268adbf19eab4a2","https://git.kernel.org/stable/c/7cdb9a9da935c687563cc682155461fef5f9b48d","https://git.kernel.org/stable/c/dcb171931954c51a1a7250d558f02b8f36570783"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-71099","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-71099","identifiers":["CVE-2025-71099"]},"retained":false,"historicalAffected":[]}],"coverage":[]}