Linux kernel (drivers/gpu/drm/xe): The observation-config ioctl dereferences the config object after releasing the lock

Impact

The observation-config ioctl dereferences the config object after releasing the lock that guards its lifetime, so a second thread that guesses the freshly allocated config id and removes it wins the race and frees the object mid-use. The upstream description names the attacker explicitly - this is a deliberate ioctl-versus-ioctl race producing a kernel use-after-free.

Who can reach it

A tenant process holding /dev/dri/renderD* on an Intel xe GPU runs add-config and remove-config in two threads, guessing the id. Reachability is conditional on the container being able to use the xe observation/OA ioctls, which normally means CAP_PERFMON inside the container or a relaxed perf_stream_paranoid setting - if you hand tenants profiling access to the GPU, they have it.

What to do

Boot a kernel carrying the xe_oa locking fix below. Interim: do not grant CAP_PERFMON to tenant containers, keep kernel.perf_event_paranoid/xe observation defaults strict, and drop GPU profiling access for untrusted workloads.

References

Related entries

• Linux kernel (drivers/gpu/drm/xe): The Xe userptr path takes folio locks while holding the MMU notifier lock, whichCVE-2025-37868 · Linux kernel (drivers/gpu/drm/xe)Medium
• Linux kernel (drivers/gpu/drm/xe): A batched array of VM_BIND operations could evict other buffer objects belonging toCVE-2025-40086 · Linux kernel (drivers/gpu/drm/xe)Medium
• Linux kernel (drivers/gpu/drm/xe): A tenant's jobs can occupy the same copy engines the driver needs to service GPUCVE-2024-37026 · Linux kernel (drivers/gpu/drm/xe)Medium
• Linux kernel (drivers/gpu/drm/xe): Same per-client accounting path, different failure - if the fdinfo read drops theCVE-2024-46867 · Linux kernel (drivers/gpu/drm/xe)Medium
• Linux kernel (drivers/gpu/drm/xe): User VM_BIND work is scheduled onto engines that can themselves take page faultsCVE-2024-47729 · Linux kernel (drivers/gpu/drm/xe)Medium
• Linux kernel (drivers/gpu/drm/xe): Passing a sync object that fails fence lookup makes the exec ioctl return toCVE-2024-53086 · Linux kernel (drivers/gpu/drm/xe)Medium