Executive brief
A security vulnerability has been identified in the Linux kernel's Intel Xe graphics driver. This flaw could allow a local user with basic access to the system to cause a system crash or potentially execute unauthorized code by exploiting a timing issue during graphics configuration. The issue specifically affects systems using newer Intel graphics hardware and drivers.
Technical details
A use-after-free (UAF) vulnerability exists in the xe_oa_add_config_ioctl() function within the Intel Xe graphics driver (drivers/gpu/drm/xe/xe_oa.c). The root cause is a race condition where the 'oa_config->id' is accessed after the 'metrics_lock' is released. An attacker can exploit this by calling xe_oa_remove_config_ioctl() with precise timing to free the 'oa_config' object before it is dereferenced. This local attack requires low privileges and no user interaction. The vulnerability has been patched in stable kernel releases 6.12.64, 6.18.4, and 6.19.
Affected products
- Linux Linux Kernel 6.11 to 6.12.63, 6.13 to 6.18.3
Timeline
- 2025-11-18: other: Initial patch authored
- 2026-01-08: patched: Patch committed to stable tree
- 2026-01-13: advisory: CVE-2025-71099 published