GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-71099 (GCVE-0-2025-71099)

Vulnerability from cvelistv5 – Published: 2026-01-13 15:34 – Updated: 2026-08-05 12:12
VLAI
Title
drm/xe/oa: Fix potential UAF in xe_oa_add_config_ioctl()
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/xe/oa: Fix potential UAF in xe_oa_add_config_ioctl() In xe_oa_add_config_ioctl(), we accessed oa_config->id after dropping metrics_lock. Since this lock protects the lifetime of oa_config, an attacker could guess the id and call xe_oa_remove_config_ioctl() with perfect timing, freeing oa_config before we dereference it, leading to a potential use-after-free. Fix this by caching the id in a local variable while holding the lock. v2: (Matt A) - Dropped mutex_unlock(&oa->metrics_lock) ordering change from xe_oa_remove_config_ioctl() (cherry picked from commit 28aeaed130e8e587fd1b73b6d66ca41ccc5a1a31)
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: cdf02fe1a94a768cbcd20f5c4e1a1d805f4a06c0 , < c6d30b65b7a44dac52ad49513268adbf19eab4a2 (git)
Affected: cdf02fe1a94a768cbcd20f5c4e1a1d805f4a06c0 , < 7cdb9a9da935c687563cc682155461fef5f9b48d (git)
Affected: cdf02fe1a94a768cbcd20f5c4e1a1d805f4a06c0 , < dcb171931954c51a1a7250d558f02b8f36570783 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.11
Unaffected: 0 , < 6.11 (semver)
Unaffected: 6.12.64 , ≤ 6.12.* (semver)
Unaffected: 6.18.4 , ≤ 6.18.* (semver)
Unaffected: 6.19 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/xe/xe_oa.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c6d30b65b7a44dac52ad49513268adbf19eab4a2",
              "status": "affected",
              "version": "cdf02fe1a94a768cbcd20f5c4e1a1d805f4a06c0",
              "versionType": "git"
            },
            {
              "lessThan": "7cdb9a9da935c687563cc682155461fef5f9b48d",
              "status": "affected",
              "version": "cdf02fe1a94a768cbcd20f5c4e1a1d805f4a06c0",
              "versionType": "git"
            },
            {
              "lessThan": "dcb171931954c51a1a7250d558f02b8f36570783",
              "status": "affected",
              "version": "cdf02fe1a94a768cbcd20f5c4e1a1d805f4a06c0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/xe/xe_oa.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.64",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.64",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.4",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/oa: Fix potential UAF in xe_oa_add_config_ioctl()\n\nIn xe_oa_add_config_ioctl(), we accessed oa_config-\u003eid after dropping\nmetrics_lock. Since this lock protects the lifetime of oa_config, an\nattacker could guess the id and call xe_oa_remove_config_ioctl() with\nperfect timing, freeing oa_config before we dereference it, leading to\na potential use-after-free.\n\nFix this by caching the id in a local variable while holding the lock.\n\nv2: (Matt A)\n- Dropped mutex_unlock(\u0026oa-\u003emetrics_lock) ordering change from\n  xe_oa_remove_config_ioctl()\n\n(cherry picked from commit 28aeaed130e8e587fd1b73b6d66ca41ccc5a1a31)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached through DRM_XE_OBSERVATION add/remove ioctls on a local Xe DRM device node; no network or physical path exists.\nAC:L - The attacker controls concurrent add and remove operations, and IDs are predictable because the IDR starts at 1 and selects the lowest available value. The race can be attempted repeatedly without relying on victim-controlled state.\nPR:L - The supported observation_paranoid=0 configuration permits ordinary render-node clients without capabilities. Although the default requires initial-namespace CAP_PERFMON or CAP_SYS_ADMIN, the higher-severity reasonable deployment requires only an unprivileged local account with device access.\nUI:N - The attacker triggers both sides of the race directly through concurrent ioctls, without any victim action.\nS:U - Exploitation affects the host kernel within its existing security authority and does not inherently cross a VM, IOMMU, or separate authorization boundary.\nC:H - The stale oa_config can be dereferenced after RCU reclamation and attacker-directed slab reuse, potentially exposing kernel memory through the reclaimed ID or debug UUID accesses.\nI:H - The use-after-free permits attacker-influenced heap reuse and must be treated as potentially yielding memory-corruption primitives, arbitrary writes, or kernel code execution.\nA:H - Dereferencing reclaimed or poisoned slab memory can cause a kernel oops or panic, and the attacker can repeatedly trigger the race."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:12:04.137Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c6d30b65b7a44dac52ad49513268adbf19eab4a2"
        },
        {
          "url": "https://git.kernel.org/stable/c/7cdb9a9da935c687563cc682155461fef5f9b48d"
        },
        {
          "url": "https://git.kernel.org/stable/c/dcb171931954c51a1a7250d558f02b8f36570783"
        }
      ],
      "title": "drm/xe/oa: Fix potential UAF in xe_oa_add_config_ioctl()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-71099",
    "datePublished": "2026-01-13T15:34:58.359Z",
    "dateReserved": "2026-01-13T15:30:19.650Z",
    "dateUpdated": "2026-08-05T12:12:04.137Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-71099",
      "date": "2026-09-15",
      "epss": "0.00135",
      "percentile": "0.03311"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-71099\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-01-13T16:16:09.820\",\"lastModified\":\"2026-07-30T06:24:51.087\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/xe/oa: Fix potential UAF in xe_oa_add_config_ioctl()\\n\\nIn xe_oa_add_config_ioctl(), we accessed oa_config-\u003eid after dropping\\nmetrics_lock. Since this lock protects the lifetime of oa_config, an\\nattacker could guess the id and call xe_oa_remove_config_ioctl() with\\nperfect timing, freeing oa_config before we dereference it, leading to\\na potential use-after-free.\\n\\nFix this by caching the id in a local variable while holding the lock.\\n\\nv2: (Matt A)\\n- Dropped mutex_unlock(\u0026oa-\u003emetrics_lock) ordering change from\\n  xe_oa_remove_config_ioctl()\\n\\n(cherry picked from commit 28aeaed130e8e587fd1b73b6d66ca41ccc5a1a31)\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\\n\\ndrm/xe/oa: Corrige un potencial uso despu\u00e9s de liberaci\u00f3n en xe_oa_add_config_ioctl()\\n\\nEn xe_oa_add_config_ioctl(), accedimos a oa_config-\u0026gt;id despu\u00e9s de liberar metrics_lock. Dado que este bloqueo protege la vida \u00fatil de oa_config, un atacante podr\u00eda adivinar el id y llamar a xe_oa_remove_config_ioctl() con una sincronizaci\u00f3n perfecta, liberando oa_config antes de que lo desreferenciemos, lo que lleva a un potencial uso despu\u00e9s de liberaci\u00f3n.\\n\\nEsto se corrige al almacenar en cach\u00e9 el id en una variable local mientras se mantiene el bloqueo.\\n\\nv2: (Matt A)\\n- Se elimin\u00f3 el cambio de orden de mutex_unlock(\u0026amp;oa-\u0026gt;metrics_lock) de xe_oa_remove_config_ioctl()\\n\\n(cherry picked from commit 28aeaed130e8e587fd1b73b6d66ca41ccc5a1a31)\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/xe/xe_oa.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"cdf02fe1a94a768cbcd20f5c4e1a1d805f4a06c0\",\"lessThan\":\"c6d30b65b7a44dac52ad49513268adbf19eab4a2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cdf02fe1a94a768cbcd20f5c4e1a1d805f4a06c0\",\"lessThan\":\"7cdb9a9da935c687563cc682155461fef5f9b48d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cdf02fe1a94a768cbcd20f5c4e1a1d805f4a06c0\",\"lessThan\":\"dcb171931954c51a1a7250d558f02b8f36570783\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/xe/xe_oa.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.11\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.11\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.64\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.4\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.11.1\",\"versionEndExcluding\":\"6.12.64\",\"matchCriteriaId\":\"9346F73C-1D95-40EF-8556-34B0701B89B0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.4\",\"matchCriteriaId\":\"DC988EA0-0E32-457A-BF95-89BEB31A227B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"4770BA57-3F3F-493B-8608-EC3B25254949\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"17B67AA7-40D6-4AFA-8459-F200F3D7CFD1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"C47E4CC9-C826-4FA9-B014-7FE3D9B318B2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F71D92C0-C023-48BD-B3B6-70B638EEE298\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"13580667-0A98-40CC-B29F-D12790B91BDB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"CAD1FED7-CF48-47BF-AC7D-7B6FA3C065FC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"3EF854A1-ABB1-4E93-BE9A-44569EC76C0D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"F5DC0CA6-F0AF-4DDF-A882-3DADB9A886A7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc8:*:*:*:*:*:*\",\"matchCriteriaId\":\"EB5B7DFC-C36B-45D8-922C-877569FDDF43\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/7cdb9a9da935c687563cc682155461fef5f9b48d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c6d30b65b7a44dac52ad49513268adbf19eab4a2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/dcb171931954c51a1a7250d558f02b8f36570783\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-21T20:47:13+00:00",
      "cve": "CVE-2025-71099",
      "id": "CVE-2025-71099",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/xe/oa: Fix potential UAF in xe_oa_add_config_ioctl()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-71099.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-29T01:11:19Z",
      "cve": "CVE-2025-71099",
      "id": "CVE-2025-71099",
      "initial_release_date": "2026-01-14T00:25:22Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "369",
      "product_status:recommended": "265",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-71099",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-71099.json",
      "version": "28"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.