CVE-2025-71099

A use-after-free flaw was found in the Intel Xe graphics driver's observability architecture (OA) configuration interface. In xe_oa_add_config_ioctl(), the oa_config->id is accessed after dropping the metrics_lock. An attacker could race to remove the configuration via xe_oa_remove_config_ioctl(), freeing the structure before the id is read.

Exploitation requires precise timing to win the race between add and remove config ioctls. This requires access to the Xe DRM device, typically available to video group users. The fix caches the id locally while holding the lock.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.