CVE-2025-71099
BaseFortify
Publication date: 2026-01-13
Last updated on: 2026-03-25
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.11 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | From 6.13 (inc) to 6.18.4 (exc) |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | From 6.11.1 (inc) to 6.12.64 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-416 | The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a use-after-free (UAF) issue in the Linux kernel's drm/xe/oa component, specifically in the function xe_oa_add_config_ioctl(). The problem occurs because the code accesses oa_config->id after releasing a lock (metrics_lock) that protects the lifetime of oa_config. An attacker could guess the id and call xe_oa_remove_config_ioctl() at the right time to free oa_config before it is dereferenced, leading to a potential use-after-free condition.
How can this vulnerability impact me? :
This vulnerability can lead to a use-after-free condition, which may allow an attacker to cause undefined behavior such as system crashes, memory corruption, or potentially execute arbitrary code with kernel privileges, depending on exploitation. This can compromise system stability and security.
What immediate steps should I take to mitigate this vulnerability?
Apply the patch that fixes the use-after-free vulnerability in the Linux kernel's drm/xe/oa component by updating to the fixed kernel version containing the commit 28aeaed130e8e587fd1b73b6d66ca41ccc5a1a31. This patch caches the id in a local variable while holding the lock to prevent the use-after-free condition.