Executive brief
The Linux kernel's i915 Intel GPU driver contains a memory safety bug in its performance monitoring counter validation code. A local user can trigger an out-of-bounds memory read that causes a kernel crash, disrupting GPU operations and potentially enabling privilege escalation or system instability.
Technical details
The vulnerability is a global buffer over-read in the xehp_oa_b_counters array within the i915 perf module. The array passed to reg_in_range_table() lacked a sentinel (empty) terminator entry, causing the function xehp_is_valid_b_counter_addr() to read past the array bounds when validating performance counter addresses. This was detected by KASAN (Kernel Address Sanitizer) as a read of size 4 bytes past the global array. The bug affects systems with Intel Xe-class GPUs (XEHP) when performance monitoring is invoked via perf. A fix adding an empty sentinel record {} to the array terminator was committed upstream and backported to stable kernels.
Affected products
- Linux Linux kernel 6.4.0 and earlier versions with i915 perf support for XEHP GPUs
Timeline
- 2023-07-11: disclosed: Patch authored by Andrzej Hajda
- 2023-07-17: patched: Upstream fix merged
- 2023-07-27: patched: Backported to stable kernels via commit 21d92025e80629fd5c25cd6751f8cf38c784dd4a
- 2025-10-07: advisory: CVE-2023-53646 published to NVD