Log in Start free

Vulnerability · Published Jan 13, 2026 · Assigned by Linux

CVE-2025-71099drm/xe/oa: Fix potential UAF in xe_oa_add_config_ioctl()

High 7.8

In plain English

A high-severity use-after-free in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.1%top 96.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: drm/xe/oa: Fix potential UAF in xe_oa_add_config_ioctl() In xe_oa_add_config_ioctl(), we accessed oa_config->id after dropping metrics_lock. Since this lock protects the lifetime of oa_config, an attacker could guess the id and call xe_oa_remove_config_ioctl() with perfect timing, freeing oa_config before we dereference it, leading to a potential use-after-free. Fix this by caching the id in a local variable while holding the lock. v2: (Matt A) - Dropped mutex_unlock(&oa->metrics_lock) ordering change from xe_oa_remove_config_ioctl() (cherry picked from commit 28aeaed130e8e587fd1b73b6d66ca41ccc5a1a31)

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13linux6.12.69-1DEBIAN-CVE-2025-71099
Debian:14linux6.18.5-1DEBIAN-CVE-2025-71099
Ubuntu:25.10linux6.17.0-22.22UBUNTU-CVE-2025-71099
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2025-71099
Ubuntu:25.10linux-aws6.17.0-1012.12UBUNTU-CVE-2025-71099
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2025-71099
Ubuntu:24.04:LTSlinux-aws-6.14no fix listedUBUNTU-CVE-2025-71099
Ubuntu:24.04:LTSlinux-aws-6.176.17.0-1012.12~24.04.1UBUNTU-CVE-2025-71099
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2025-71099
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2025-71099
Ubuntu:25.10linux-azure6.17.0-1013.13UBUNTU-CVE-2025-71099
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2025-71099
Ubuntu:24.04:LTSlinux-azure-6.11no fix listedUBUNTU-CVE-2025-71099
Ubuntu:24.04:LTSlinux-azure-6.14no fix listedUBUNTU-CVE-2025-71099
Ubuntu:24.04:LTSlinux-azure-6.176.17.0-1013.13~24.04.1UBUNTU-CVE-2025-71099
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2025-71099
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2025-71099
Ubuntu:25.10linux-azure-fdeno fix listedUBUNTU-CVE-2025-71099
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2025-71099
Ubuntu:24.04:LTSlinux-azure-fde-6.14no fix listedUBUNTU-CVE-2025-71099
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2025-71099
Ubuntu:24.04:LTSlinux-azure-nvidia-6.14no fix listedUBUNTU-CVE-2025-71099
Ubuntu:25.10linux-gcp6.17.0-1012.12UBUNTU-CVE-2025-71099
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2025-71099
Ubuntu:24.04:LTSlinux-gcp-6.11no fix listedUBUNTU-CVE-2025-71099
Ubuntu:24.04:LTSlinux-gcp-6.14no fix listedUBUNTU-CVE-2025-71099
Ubuntu:24.04:LTSlinux-gcp-6.176.17.0-1012.12~24.04.1UBUNTU-CVE-2025-71099
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2025-71099
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2025-71099
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2025-71099
Ubuntu:24.04:LTSlinux-hwe-6.11no fix listedUBUNTU-CVE-2025-71099
Ubuntu:24.04:LTSlinux-hwe-6.14no fix listedUBUNTU-CVE-2025-71099
Ubuntu:24.04:LTSlinux-hwe-6.176.17.0-22.22~24.04.1UBUNTU-CVE-2025-71099
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2025-71099
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2025-71099
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2025-71099
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2025-71099
Ubuntu:24.04:LTSlinux-lowlatency-hwe-6.11no fix listedUBUNTU-CVE-2025-71099
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2025-71099
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2025-71099
Ubuntu:24.04:LTSlinux-nvidia-6.11no fix listedUBUNTU-CVE-2025-71099
Ubuntu:24.04:LTSlinux-nvidia-6.176.17.0-1018.18UBUNTU-CVE-2025-71099
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2025-71099
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2025-71099
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2025-71099
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2025-71099
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2025-71099
Ubuntu:24.04:LTSlinux-oem-6.11no fix listedUBUNTU-CVE-2025-71099
Ubuntu:24.04:LTSlinux-oem-6.14no fix listedUBUNTU-CVE-2025-71099
Ubuntu:24.04:LTSlinux-oem-6.176.17.0-1020.20UBUNTU-CVE-2025-71099
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2025-71099
Ubuntu:24.04:LTSlinux-oem-6.8no fix listedUBUNTU-CVE-2025-71099
Ubuntu:25.10linux-oracle6.17.0-1011.11UBUNTU-CVE-2025-71099
Ubuntu:24.04:LTSlinux-oracle-6.14no fix listedUBUNTU-CVE-2025-71099
Ubuntu:24.04:LTSlinux-oracle-6.176.17.0-1011.11~24.04.1UBUNTU-CVE-2025-71099
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2025-71099
Ubuntu:25.10linux-raspi6.17.0-1013.13UBUNTU-CVE-2025-71099
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2025-71099
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2025-71099
Ubuntu:24.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2025-71099
Ubuntu:25.10linux-realtime6.17.0-1010.11UBUNTU-CVE-2025-71099
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2025-71099
Ubuntu:24.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2025-71099
Ubuntu:25.10linux-riscv6.17.0-22.22.1UBUNTU-CVE-2025-71099
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2025-71099
Ubuntu:24.04:LTSlinux-riscv-6.14no fix listedUBUNTU-CVE-2025-71099
Ubuntu:24.04:LTSlinux-riscv-6.176.17.0-22.22.1~24.04.1UBUNTU-CVE-2025-71099
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2025-71099
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2025-71099
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2025-71099
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2025-71099

Affected products (as reported)

VendorProductVersions
Linux Linux cdf02fe1a94a768cbcd20f5c4e1a1d805f4a06c0 – before c6d30b65b7a44dac52ad49513268adbf19eab4a2cdf02fe1a94a768cbcd20f5c4e1a1d805f4a06c0 – before 7cdb9a9da935c687563cc682155461fef5f9b48dcdf02fe1a94a768cbcd20f5c4e1a1d805f4a06c0 – before dcb171931954c51a1a7250d558f02b8f36570783
Linux Linux 6.11

Weakness: CWE-416 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References