---
id: CVE-2023-54202
title: 'drm/i915: fix race condition UAF in i915_perf_add_config_ioctl'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/i915: fix race condition UAF in i915_perf_add_config_ioctl

  Userspace can guess the id value and try to race oa_config object creation
  with config remove, resulting…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= f89823c212246d0671cc51e69894a3df1a743aee <
    6eeb1cba4c9dc47656ea328afa34953c28783d8c
  - >-
    Linux >= f89823c212246d0671cc51e69894a3df1a743aee <
    240b1502708858b5e3f10b6dc5ca3f148a322fef
  - >-
    Linux >= f89823c212246d0671cc51e69894a3df1a743aee <
    7eb98f5ac551863efe8be810cea1cd5411d677b1
  - >-
    Linux >= f89823c212246d0671cc51e69894a3df1a743aee <
    dc30c011469165d57af9adac5baff7d767d20e5c
  - Linux 4.14
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-15T21:39:18.311903Z'
published: '2025-12-30'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T21:41:41.415Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2023-54202'
references:
  - url: 'https://git.kernel.org/stable/c/6eeb1cba4c9dc47656ea328afa34953c28783d8c'
  - url: 'https://git.kernel.org/stable/c/240b1502708858b5e3f10b6dc5ca3f148a322fef'
  - url: 'https://git.kernel.org/stable/c/7eb98f5ac551863efe8be810cea1cd5411d677b1'
  - url: 'https://git.kernel.org/stable/c/dc30c011469165d57af9adac5baff7d767d20e5c'
tags:
  - cve.org
epss: 0.0015
epssPercentile: 0.03743
ingestedAt: '2026-10-15T22:48:25.433Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/i915: fix race condition UAF in i915_perf_add_config_ioctl

Userspace can guess the id value and try to race oa_config object creation
with config remove, resulting in a use-after-free if we dereference the
object after unlocking the metrics_lock.  For that reason, unlocking the
metrics_lock must be done after we are done dereferencing the object.

[tursulin: Manually added stable tag.]
(cherry picked from commit 49f6f6483b652108bcb73accd0204a464b922395)

## Affected

- `Linux >= f89823c212246d0671cc51e69894a3df1a743aee < 6eeb1cba4c9dc47656ea328afa34953c28783d8c`
- `Linux >= f89823c212246d0671cc51e69894a3df1a743aee < 240b1502708858b5e3f10b6dc5ca3f148a322fef`
- `Linux >= f89823c212246d0671cc51e69894a3df1a743aee < 7eb98f5ac551863efe8be810cea1cd5411d677b1`
- `Linux >= f89823c212246d0671cc51e69894a3df1a743aee < dc30c011469165d57af9adac5baff7d767d20e5c`
- `Linux 4.14`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.