{"id":"CVE-2025-71099","title":"drm/xe/oa: Fix potential UAF in xe_oa_add_config_ioctl()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/oa: Fix potential UAF in xe_oa_add_config_ioctl()\n\nIn xe_oa_add_config_ioctl(), we accessed oa_config->id after dropping\nmetrics_lock. Since this lock protects t…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= cdf02fe1a94a768cbcd20f5c4e1a1d805f4a06c0 < c6d30b65b7a44dac52ad49513268adbf19eab4a2","Linux >= cdf02fe1a94a768cbcd20f5c4e1a1d805f4a06c0 < 7cdb9a9da935c687563cc682155461fef5f9b48d","Linux >= cdf02fe1a94a768cbcd20f5c4e1a1d805f4a06c0 < dcb171931954c51a1a7250d558f02b8f36570783","Linux 6.11"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T15:05:43.168624Z"},"published":"2026-01-13","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:09:46.242Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-71099","references":[{"url":"https://git.kernel.org/stable/c/c6d30b65b7a44dac52ad49513268adbf19eab4a2"},{"url":"https://git.kernel.org/stable/c/7cdb9a9da935c687563cc682155461fef5f9b48d"},{"url":"https://git.kernel.org/stable/c/dcb171931954c51a1a7250d558f02b8f36570783"}],"tags":["cve.org"],"epss":0.00138,"epssPercentile":0.0284,"ingestedAt":"2026-10-16T17:24:46.636Z","slug":"CVE-2025-71099","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/oa: Fix potential UAF in xe_oa_add_config_ioctl()\n\nIn xe_oa_add_config_ioctl(), we accessed oa_config->id after dropping\nmetrics_lock. Since this lock protects the lifetime of oa_config, an\nattacker could guess the id and call xe_oa_remove_config_ioctl() with\nperfect timing, freeing oa_config before we dereference it, leading to\na potential use-after-free.\n\nFix this by caching the id in a local variable while holding the lock.\n\nv2: (Matt A)\n- Dropped mutex_unlock(&oa->metrics_lock) ordering change from\n  xe_oa_remove_config_ioctl()\n\n(cherry picked from commit 28aeaed130e8e587fd1b73b6d66ca41ccc5a1a31)\n\n## Affected\n\n- `Linux >= cdf02fe1a94a768cbcd20f5c4e1a1d805f4a06c0 < c6d30b65b7a44dac52ad49513268adbf19eab4a2`\n- `Linux >= cdf02fe1a94a768cbcd20f5c4e1a1d805f4a06c0 < 7cdb9a9da935c687563cc682155461fef5f9b48d`\n- `Linux >= cdf02fe1a94a768cbcd20f5c4e1a1d805f4a06c0 < dcb171931954c51a1a7250d558f02b8f36570783`\n- `Linux 6.11`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}