CVE-2025-71099: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71099 is a use-after-free (UAF) vulnerability in the Linux kernel's DRM xe driver OA (Observation Architecture) subsystem, specifically within the xe_oa_add_config_ioctl() function. It was published on January 13, 2026, and affects Linux kernel versions 6.11.1 through 6.12.63, 6.13 through 6.18.3, and release candidates 6.19-rc1 through 6.19-rc8. The vulnerability carries a CVSS v3.1 base score of 7.8 (High) (Red Hat Advisory, Feedly).

The root cause is a classic time-of-check/time-of-use (TOCTOU) race condition classified as CWE-416 (Use After Free). In xe_oa_add_config_ioctl(), the code accesses oa_config->id after releasing the metrics_lock mutex, which is responsible for protecting the lifetime of the oa_config object. A local attacker with low privileges can exploit this by guessing the configuration ID and calling xe_oa_remove_config_ioctl() with precise timing to free the oa_config object before it is dereferenced in the original thread, triggering the UAF condition. The fix caches the ID in a local variable while the lock is still held, eliminating the window of vulnerability (cherry-picked from upstream commit 28aeaed130e8e587fd1b73b6d66ca41ccc5a1a31) (Feedly, kernel.org patches).

Successful exploitation by a local low-privileged attacker can result in high confidentiality, integrity, and availability impacts — including reading sensitive kernel memory, modifying memory contents, or crashing the kernel (denial of service). The vulnerability is confined to the local attack surface and does not allow remote exploitation, but on multi-tenant or shared systems it could enable privilege escalation or lateral movement within the host (Feedly).

The vulnerability has been patched in Linux kernel versions 6.12.64 and later, and 6.18.4 and later (including 6.19-rc1+). Patches are available at the upstream stable kernel repository (kernel.org patch 1, kernel.org patch 2, kernel.org patch 3). Ubuntu has issued security notices USN-8177-1, USN-8177-2, USN-8183-1, USN-8183-2, USN-8245-1, and USN-8257-1 addressing this issue (Ubuntu USN-8177-1, Ubuntu USN-8183-1). For systems that cannot be immediately patched, restrict access to DRM device interfaces, apply the principle of least privilege, and consider disabling the DRM xe driver if not in active use (Feedly).

Red Hat has acknowledged the vulnerability and published a security advisory. Ubuntu has issued multiple security notices (USN-8177-1/2, USN-8183-1/2, USN-8245-1, USN-8257-1) addressing the issue across affected kernel packages. The Yocto Project security mailing list has also tracked this CVE. No notable independent researcher commentary or significant social media discussion has been identified (Red Hat Advisory, Ubuntu USN-8177-1).