Description
In the Linux kernel, the following vulnerability has been resolved: drm/i915: fix race condition UAF in i915_perf_add_config_ioctl Userspace can guess the id value and try to race oa_config object creation with config remove, resulting in a use-after-free if we dereference the object after unlocking the metrics_lock. For that reason, unlocking the metrics_lock must be done after we are done dereferencing the object. [tursulin: Manually added stable tag.] (cherry picked from commit 49f6f6483b652108bcb73accd0204a464b922395)
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
f89823c212246d0671cc51e69894a3df1a743aee to < 6eeb1cba4c9dc47656ea328afa34953c28783d8caffectedf89823c212246d0671cc51e69894a3df1a743aee to < 240b1502708858b5e3f10b6dc5ca3f148a322fefaffectedf89823c212246d0671cc51e69894a3df1a743aee to < 7eb98f5ac551863efe8be810cea1cd5411d677b1affectedf89823c212246d0671cc51e69894a3df1a743aee to < dc30c011469165d57af9adac5baff7d767d20e5caffected
Linux Linux
Default version status: affected
4.14affected0 to < 4.14unaffected5.15.108 to ≤ 5.15.*unaffected6.1.24 to ≤ 6.1.*unaffected6.2.11 to ≤ 6.2.*unaffected6.3 to ≤ *unaffected