vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2023-54202

drm/i915: fix race condition UAF in i915_perf_add_config_ioctl

HIGH
7.8
CVSS Score
Published: December 30, 2025 at 12:09 PM UTC
Updated: October 28, 2026 at 07:10 PM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH7.8
Exploit prediction
EPSS 0.1%
SSVC
No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: drm/i915: fix race condition UAF in i915_perf_add_config_ioctl Userspace can guess the id value and try to race oa_config object creation with config remove, resulting in a use-after-free if we dereference the object after unlocking the metrics_lock. For that reason, unlocking the metrics_lock must be done after we are done dereferencing the object. [tursulin: Manually added stable tag.] (cherry picked from commit 49f6f6483b652108bcb73accd0204a464b922395)

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel· Linux
90%
4.14f89823c212246d0671cc51e69894a3df1a743aee
Vendor states this is fixed in 240b1502708858b5e3f10b6dc5ca3f148a322fef (fixed)
Vendor states this is fixed in 6eeb1cba4c9dc47656ea328afa34953c28783d8c (fixed)
Vendor states this is fixed in 7eb98f5ac551863efe8be810cea1cd5411d677b1 (fixed)
Vendor states this is fixed in dc30c011469165d57af9adac5baff7d767d20e5c (fixed)
Vendor states this is fixed in 4.14 (unaffected)
Vendor states this is fixed in 5.15.108 (unaffected)
Vendor states this is fixed in 6.1.24 (unaffected)
Vendor states this is fixed in 6.2.11 (unaffected)
Vendor states this is fixed in 6.3 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (4)

Source: cverecord
https://git.kernel.org/stable/c/6eeb1cba4c9dc47656ea328afa34953c28783d8c
Source: cverecord
https://git.kernel.org/stable/c/240b1502708858b5e3f10b6dc5ca3f148a322fef
Source: cverecord
https://git.kernel.org/stable/c/7eb98f5ac551863efe8be810cea1cd5411d677b1
Source: cverecord
https://git.kernel.org/stable/c/dc30c011469165d57af9adac5baff7d767d20e5c

SSVC — Action Prioritization

SSVCNo known exploitNot automatableTotal impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

7.8HIGHLinux
Vector?

Quick Info

StatusDEFERRED

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card