High 7.8Published Dec 30, 2025

CVE-2023-54202drm/i915: fix race condition UAF in i915_perf_add_config_ioctl

Updated under an hour ago (2026-10-19 07:23 UTC)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: drm/i915: fix race condition UAF in i915_perf_add_config_ioctl Userspace can guess the id value and try to race oa_config object creation with config remove, resulting in a use-after-free if we dereference the object after unlocking the metrics_lock. For that reason, unlocking the metrics_lock must be done after we are done dereferencing the object. [tursulin: Manually added stable tag.] (cherry picked from commit 49f6f6483b652108bcb73accd0204a464b922395)

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Deferred
Record last updated: Oct 15, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from f89823c212246d0671cc51e69894a3df1a743aee before 6eeb1cba4c9dc47656ea328afa34953c28783d8c; from f89823c212246d0671cc51e69894a3df1a743aee before 240b1502708858b5e3f10b6dc5ca3f148a322fef; from f89823c212246d0671cc51e69894a3df1a743aee before 7eb98f5ac551863efe8be810cea1cd5411d677b1; from f89823c212246d0671cc51e69894a3df1a743aee before dc30c011469165d57af9adac5baff7d767d20e5c	CNA record

References

https://git.kernel.org/stable/c/6eeb1cba4c9dc47656ea328afa34953c28783d8c
https://git.kernel.org/stable/c/240b1502708858b5e3f10b6dc5ca3f148a322fef
https://git.kernel.org/stable/c/7eb98f5ac551863efe8be810cea1cd5411d677b1
https://git.kernel.org/stable/c/dc30c011469165d57af9adac5baff7d767d20e5c

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.