LiveActive security incident?Get immediate response
CVE Record

CVE-2023-54202: drm/i915: fix race condition UAF in i915_perf_add_config_ioctl

In the Linux kernel, the following vulnerability has been resolved: drm/i915: fix race condition UAF in i915_perf_add_config_ioctl Userspace can guess the id value and try to race oa_config object creation with config remove, resulting in a use-after-free if we dereference the object after unlocking the metrics_lock. For that reason, unlocking the metrics_lock must be done after we are done dereferencing the object. [tursulin: Manually added stable tag.] (cherry picked from commit 49f6f6483b652108bcb73accd0204a464b922395)

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2023-54202 is a Linux kernel Intel i915 graphics driver flaw. A local userspace process may trigger a race in performance configuration handling, causing use-after-free behavior. The source bundle does not provide CVSS, confirmed impact, or active exploitation evidence, so urgency depends on whether exposed systems use affected Linux kernels and the i915 driver.

Executive priority

Handle through normal kernel patch management, with higher priority for shared workstations, multi-user Linux systems, or hosts running untrusted local code. Current public evidence does not support emergency treatment, but kernel use-after-free flaws can become more serious as details mature.

Technical view

The issue is in drm/i915 i915_perf_add_config_ioctl. Userspace can guess an OA config id and race object creation with config removal. The fix keeps metrics_lock held until the object is no longer dereferenced, preventing a use-after-free after unlock. Stable kernel commits are referenced as the remediation source.

Likely exposure

Likely exposure is Linux systems running affected kernel versions or branches with the Intel i915 DRM driver enabled. The bundle lists Linux as affected, including version entries for 4.14, 5.15.108, 6.1.24, 6.2.11, and 6.3, but does not provide distro-specific package mappings.

Exploitation context

The bundle describes a race reachable from userspace, but provides no exploit code, no CVSS, and no CISA KEV listing. There is no source-backed evidence here of active exploitation. Treat this as a local kernel attack-surface issue until vendor advisories provide more detail.

Researcher notes

Key evidence is the upstream resolution text: an OA config id race can cause dereference after metrics_lock is released. The source data is sparse: no CWE, CVSS, CPEs, exploit status, or distribution advisories are included. Validate against kernel commit ancestry and downstream backports.

Mitigation direction

  • Update Linux kernels to builds containing the referenced stable i915 fixes.
  • Check distribution advisories for package names and fixed kernel versions.
  • Prioritize systems with Intel graphics and untrusted local users or workloads.
  • If patching is delayed, reduce untrusted local shell or workload access.
  • Monitor kernel and distro guidance for revised severity or impact details.

Validation and detection

  • Inventory Linux hosts and record kernel versions and hardware graphics drivers.
  • Confirm whether the i915 DRM driver is present or loaded.
  • Compare installed kernels against vendor-fixed packages or referenced stable commits.
  • Review access models for local users, containers, and desktop workloads.
  • Track CVE updates for CVSS, affected ranges, and distro-specific status.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-54202 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
5Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxf89823c212246d0671cc51e69894a3df1a743aee, f89823c212246d0671cc51e69894a3df1a743aee, f89823c212246d0671cc51e69894a3df1a743aee, f89823c212246d0671cc51e69894a3df1a743aeeunaffected
LinuxLinux4.14, 0, 5.15.108, 6.1.24, 6.2.11, 6.3affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.