---
id: CVE-2025-71099
title: 'drm/xe/oa: Fix potential UAF in xe_oa_add_config_ioctl()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/xe/oa: Fix potential UAF in xe_oa_add_config_ioctl()

  In xe_oa_add_config_ioctl(), we accessed oa_config->id after dropping
  metrics_lock. Since this lock protects t…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= cdf02fe1a94a768cbcd20f5c4e1a1d805f4a06c0 <
    c6d30b65b7a44dac52ad49513268adbf19eab4a2
  - >-
    Linux >= cdf02fe1a94a768cbcd20f5c4e1a1d805f4a06c0 <
    7cdb9a9da935c687563cc682155461fef5f9b48d
  - >-
    Linux >= cdf02fe1a94a768cbcd20f5c4e1a1d805f4a06c0 <
    dcb171931954c51a1a7250d558f02b8f36570783
  - Linux 6.11
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:05:43.168624Z'
published: '2026-01-13'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:09:46.242Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-71099'
references:
  - url: 'https://git.kernel.org/stable/c/c6d30b65b7a44dac52ad49513268adbf19eab4a2'
  - url: 'https://git.kernel.org/stable/c/7cdb9a9da935c687563cc682155461fef5f9b48d'
  - url: 'https://git.kernel.org/stable/c/dcb171931954c51a1a7250d558f02b8f36570783'
tags:
  - cve.org
epss: 0.00138
epssPercentile: 0.0284
ingestedAt: '2026-10-16T17:24:46.636Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/xe/oa: Fix potential UAF in xe_oa_add_config_ioctl()

In xe_oa_add_config_ioctl(), we accessed oa_config->id after dropping
metrics_lock. Since this lock protects the lifetime of oa_config, an
attacker could guess the id and call xe_oa_remove_config_ioctl() with
perfect timing, freeing oa_config before we dereference it, leading to
a potential use-after-free.

Fix this by caching the id in a local variable while holding the lock.

v2: (Matt A)
- Dropped mutex_unlock(&oa->metrics_lock) ordering change from
  xe_oa_remove_config_ioctl()

(cherry picked from commit 28aeaed130e8e587fd1b73b6d66ca41ccc5a1a31)

## Affected

- `Linux >= cdf02fe1a94a768cbcd20f5c4e1a1d805f4a06c0 < c6d30b65b7a44dac52ad49513268adbf19eab4a2`
- `Linux >= cdf02fe1a94a768cbcd20f5c4e1a1d805f4a06c0 < 7cdb9a9da935c687563cc682155461fef5f9b48d`
- `Linux >= cdf02fe1a94a768cbcd20f5c4e1a1d805f4a06c0 < dcb171931954c51a1a7250d558f02b8f36570783`
- `Linux 6.11`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.