CVE-2023-54202: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54202 is a use-after-free (UAF) race condition vulnerability in the Linux kernel's DRM/i915 subsystem, specifically within the i915_perf_add_config_ioctl function. A local attacker can race oa_config object creation against a concurrent config removal operation by guessing the ID value, leading to a UAF condition when the object is dereferenced after metrics_lock is released. The vulnerability affects Linux kernel versions from commit f89823c212246d0671cc51e69894a3df1a743aee up to the patched stable releases. It was published on December 30, 2025, with an estimated CVSS severity of Medium and an EPSS score of 0.025% (Feedly, EUVD).

The root cause is a time-of-check to time-of-use (TOCTOU) race condition (CWE-416: Use After Free) in the i915_perf_add_config_ioctl path of the Intel i915 GPU driver. When userspace submits an ioctl to add a performance monitoring (OA) configuration, it can concurrently trigger a config removal using a guessed ID value. If metrics_lock is released before the code finishes dereferencing the oa_config object, a concurrent removal can free the object, leaving a dangling pointer that is subsequently accessed. The fix ensures metrics_lock is held until all dereferences of the object are complete. The upstream fix was cherry-picked from commit 49f6f6483b652108bcb73accd0204a464b922395 (Feedly, EUVD).

Successful exploitation of this race condition could allow a local, unprivileged user to trigger a use-after-free in kernel memory, potentially leading to kernel memory corruption, privilege escalation, or a system crash (denial of service). The vulnerability is confined to systems with Intel i915 GPU hardware and the DRM/i915 kernel module loaded. While the primary risk is local privilege escalation or system instability, exploitation in containerized or multi-tenant environments could have broader impact (Feedly, EUVD).

The Linux kernel stable tree has released patches addressing this vulnerability in the following versions: 5.15.108, 6.1.24, 6.2.11, and 6.3. Administrators should update to these or later stable kernel releases. The fix ensures that metrics_lock is not released until all dereferences of the oa_config object are complete, eliminating the race window. Patch commits are available in the Linux stable kernel repository (EUVD, Kernel Stable).