Executive brief
The Linux kernel's Intel GPU (i915) driver has a use-after-free vulnerability in how it handles request objects submitted to Graphics Micro Controller (GuC) virtual engines. When userspace applications hold references to these requests indefinitely through sync files or shared memory buffers, the kernel could access freed memory during cleanup, potentially allowing a local attacker to crash the system or execute code with kernel privileges.
Technical details
This is a use-after-free vulnerability (CWE-416) in the i915 DRM driver's fence release path. The root cause involves references to i915_request objects being held indefinitely by userspace through sync_file or dmabuf (dma-resv) mechanisms across multiple processes. The vulnerable component is the i915_fence_release() function, which previously could dereference rq->engine without properly checking if the request was associated with a virtual engine. The fix introduces a VIRTUAL_ENGINES bit flag in the execution_mask field to mark virtual engine requests, allowing the release path to correctly validate engine pointers before use. The vulnerability requires local system access and ability to submit GPU work, but no specific preconditions beyond normal GPU usage. Patches are available in upstream kernel commits 5eefc5307c983b59344a4cb89009819f580c84fa and later.
Affected products
- Linux Linux Kernel versions prior to fix commit 5eefc5307c983b59344a4cb89009819f580c84fa (approximately 5.13+)
Timeline
- 2023-08-21: disclosed: Patch commit 5eefc5307c983b59344a4cb89009819f580c84fa authored
- 2023-08-30: patched: Patch merged to mainline kernel
- 2025-10-04: advisory: CVE-2023-53552 published