https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 03:13:28 +0000 https://vulnerability.circl.lu/vuln/cve-2025-71099 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>drm/xe/oa: Fix potential UAF in xe_oa_add_config_ioctl()</p> <p>In xe_oa_add_config_ioctl(), we accessed oa_config-&gt;id after dropping metrics_lock. Since this lock protects the lifetime of oa_config, an attacker could guess the id and call xe_oa_remove_config_ioctl() with perfect timing, freeing oa_config before we dereference it, leading to a potential use-after-free.</p> <p>Fix this by caching the id in a local variable while holding the lock.</p> <p>v2: (Matt A) - Dropped mutex_unlock(&amp;oa-&gt;metrics_lock) ordering change from xe_oa_remove_config_ioctl()</p> <p>(cherry picked from commit 28aeaed130e8e587fd1b73b6d66ca41ccc5a1a31)</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>drm/xe/oa: Fix potential UAF in xe_oa_add_config_ioctl()</p> <p>In xe_oa_add_config_ioctl(), we accessed oa_config-&gt;id after dropping metrics_lock. Since this lock protects the lifetime of oa_config, an attacker could guess the id and call xe_oa_remove_config_ioctl() with perfect timing, freeing oa_config before we dereference it, leading to a potential use-after-free.</p> <p>Fix this by caching the id in a local variable while holding the lock.</p> <p>v2: (Matt A) - Dropped mutex_unlock(&amp;oa-&gt;metrics_lock) ordering change from xe_oa_remove_config_ioctl()</p> <p>(cherry picked from commit 28aeaed130e8e587fd1b73b6d66ca41ccc5a1a31)</p> https://vulnerability.circl.lu/vuln/cve-2025-71099