CVE-2023-53646

drm/i915/perf: add sentinel to xehp_oa_b_counters

7.8 HighFix available

In the Linux kernel, the following vulnerability has been resolved:

drm/i915/perf: add sentinel to xehp_oa_b_counters

Arrays passed to reg_in_range_table should end with empty record.

The patch solves KASAN detected bug with signature: BUG: KASAN: global-out-of-bounds in xehp_is_valid_b_counter_addr+0x2c7/0x350 [i915] Read of size 4 at addr ffffffffa1555d90 by task perf/1518

CPU: 4 PID: 1518 Comm: perf Tainted: G U 6.4.0-kasan_438-g3303d06107f3+ #1 Hardware name: Intel Corporation Meteor Lake Client Platform/MTL-P DDR5 SODIMM SBS RVP, BIOS MTLPFWI1.R00.3223.D80.2305311348 05/31/2023 Call Trace: <TASK> ... xehp_is_valid_b_counter_addr+0x2c7/0x350 [i915]

(cherry picked from commit 2f42c5afb34b5696cf5fe79e744f99be9b218798)

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.20%Up 0.2 points since Oct 8, 2025

What each source reports

CVE List Score used7.8

drm/i915/perf: add sentinel to xehp_oa_b_counters

In the Linux kernel, the following vulnerability has been resolved:

drm/i915/perf: add sentinel to xehp_oa_b_counters

Arrays passed to reg_in_range_table should end with empty record.

The patch solves KASAN detected bug with signature: BUG: KASAN: global-out-of-bounds in xehp_is_valid_b_counter_addr+0x2c7/0x350 [i915] Read of size 4 at addr ffffffffa1555d90 by task perf/1518

(cherry picked from commit 2f42c5afb34b5696cf5fe79e744f99be9b218798)

Record: CVE-2023-53646
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

EUVDEUVD-2025-319457.8

In the Linux kernel, the following vulnerability has been resolved:

drm/i915/perf: add sentinel to xehp_oa_b_counters

Arrays passed to reg_in_range_table should end with empty record.

The patch solves KASAN detected bug with signature: BUG: KASAN: global-out-of-bounds in xehp_is_valid_b_counter_addr+0x2c7/0x350 [i915] Read of size 4 at addr ffffffffa1555d90 by task perf/1518

(cherry picked from commit 2f42c5afb34b5696cf5fe79e744f99be9b218798)

Record: EUVD-2025-31945
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-v24g-q75p-xqch7.1

In the Linux kernel, the following vulnerability has been resolved: drm/i915/perf: add sentinel...

In the Linux kernel, the following vulnerability has been resolved:

drm/i915/perf: add sentinel to xehp_oa_b_counters

Arrays passed to reg_in_range_table should end with empty record.

The patch solves KASAN detected bug with signature: BUG: KASAN: global-out-of-bounds in xehp_is_valid_b_counter_addr+0x2c7/0x350 [i915] Read of size 4 at addr ffffffffa1555d90 by task perf/1518

(cherry picked from commit 2f42c5afb34b5696cf5fe79e744f99be9b218798)

Record: GHSA-v24g-q75p-xqch
CVSS 3.1: 7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Weakness: CWE-125
Updated: 2026-11-02

NVD7.8

In the Linux kernel, the following vulnerability has been resolved:

drm/i915/perf: add sentinel to xehp_oa_b_counters

Arrays passed to reg_in_range_table should end with empty record.

The patch solves KASAN detected bug with signature: BUG: KASAN: global-out-of-bounds in xehp_is_valid_b_counter_addr+0x2c7/0x350 [i915] Read of size 4 at addr ffffffffa1555d90 by task perf/1518

(cherry picked from commit 2f42c5afb34b5696cf5fe79e744f99be9b218798)

Record: CVE-2023-53646
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1: 7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Weakness: CWE-125
Updated: 2026-11-02

OSVBELL-CVE-2023-536467.1

Record: BELL-CVE-2023-53646
CVSS 3.1: 7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Updated: 2026-11-02

OSV7.8

drm/i915/perf: add sentinel to xehp_oa_b_counters

In the Linux kernel, the following vulnerability has been resolved:

drm/i915/perf: add sentinel to xehp_oa_b_counters

Arrays passed to reg_in_range_table should end with empty record.

The patch solves KASAN detected bug with signature: BUG: KASAN: global-out-of-bounds in xehp_is_valid_b_counter_addr+0x2c7/0x350 [i915] Read of size 4 at addr ffffffffa1555d90 by task perf/1518

(cherry picked from commit 2f42c5afb34b5696cf5fe79e744f99be9b218798)

Record: CVE-2023-53646
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 16 moreShow less

OSVDEBIAN-CVE-2023-536467.1

In the Linux kernel, the following vulnerability has been resolved: drm/i915/perf: add sentinel to xehp_oa_b_counters Arrays passed to reg_in_range_table should end with empty record. The patch solves KASAN detected bug with signature: BUG: KASAN: global-out-of-bounds in xehp_is_valid_b_counter_addr+0x2c7/0x350 [i915] Read of size 4 at addr ffffffffa1555d90 by task perf/1518 CPU: 4 PID: 1518 Comm: perf Tainted: G U 6.4.0-kasan_438-g3303d06107f3+ #1 Hardware name: Intel Corporation Meteor Lake Client Platform/MTL-P DDR5 SODIMM SBS RVP, BIOS MTLPFWI1.R00.3223.D80.2305311348 05/31/2023 Call Trace: <TASK> ... xehp_is_valid_b_counter_addr+0x2c7/0x350 [i915] (cherry picked from commit 2f42c5afb34b5696cf5fe79e744f99be9b218798)

Record: DEBIAN-CVE-2023-53646
CVSS 3.1: 7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2023:65838.2

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Record: RHSA-2023:6583
CVSS 3.1: 8.2 HighCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2023:70777.8

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Record: RHSA-2023:7077
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2024:23947.8

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Record: RHSA-2024:2394
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2023-536467.1

Record: UBUNTU-CVE-2023-53646
CVSS 3.1: 7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVCLSA-2026-1780132980No score

kernel: Fix of 46 CVEs

tracing: Fix potential double free in create_var_ref() {CVE-2022-49410}
scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() {CVE-2026-23216}
e1000: fix OOB in e1000_tbi_should_accept() {CVE-2025-71093}
module: limit enabling module.sig_enforce {CVE-2021-35039}
Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm {CVE-2022-42896}
HID: elan: Fix potential double free in elan_input_configured {CVE-2022-49508}
libceph: make decode_pool() more resilient against corrupted osdmaps {CVE-2025-71116}
scsi: qla2xxx: Fix improper freeing of purex item {CVE-2025-68741}
binfmt_misc: fix shift-out-of-bounds in check_special_flags {CVE-2022-50497}
ring-buffer: Fix deadloop issue on reading trace_pipe {CVE-2023-53668}
kernfs: fix use-after-free in __kernfs_remove {CVE-2022-50432}
rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails {CVE-2023-53307}
virtio_console: Assure used length from device is limited {CVE-2021-38160}
Squashfs: check metadata block offset is within range {CVE-2026-23388}
Input: powermate - fix use-after-free in powermate_config_complete {CVE-2023-52475}
wifi: iwlwifi: mvm: Fix a memory corruption issue {CVE-2023-52531}
cifs: Fix use-after-free in rdata->read_into_pages() {CVE-2023-52741}
ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path() {CVE-2023-52988}
selinux: Add boundary check in put_entry() {CVE-2022-50200}
nvmet: avoid potential UAF in nvmet_req_complete() {CVE-2023-53116}
ext4: add bounds checking in get_max_inline_xattr_value_size() {CVE-2023-53285}
drm/i915/perf: add sentinel to xehp_oa_b_counters {CVE-2023-53646}
net: mdio: validate parameter addr in mdiobus_get_phy() {CVE-2023-53019}
wifi: nl80211: fix integer overflow in nl80211_parse_mbssid_elems() {CVE-2023-53570}
vt: Clear selection before changing the font {CVE-2022-49948}
ipvs: fix WARNING in ip_vs_app_net_cleanup() {CVE-2022-49917}
netlink: prevent potential spectre v1 gadgets {CVE-2023-53000}
net: mdio: fix undefined behavior in bit shift for __mdiobus_register {CVE-2022-49907}
capabilities: fix undefined behavior in bit shift for CAP_TO_MASK {CVE-2022-49870}
powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue {CVE-2022-50366}
lwt: Fix return values of BPF xmit ops {CVE-2023-53338}
ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS {CVE-2022-50315}
udf: Do not bother merging very long extents {CVE-2023-53506}
gfs2: Fix possible data races in gfs2_show_options() {CVE-2023-53622}
wifi: mac80211_hwsim: drop short frames {CVE-2023-53321}
thermal: core: prevent potential string overflow {CVE-2023-52868}
drm/radeon: possible buffer overflow {CVE-2023-52867}
ftrace: Fix invalid address access in lookup_rec() when index is 0 {CVE-2023-53075}
net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak {CVE-2026-43040}
drm/amd/display: Skip inactive planes within ModeSupportAndSystemConfiguration {CVE-2024-46812}
Bluetooth: MGMT: validate LTK enc_size on load {CVE-2026-43020}
drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() {CVE-2026-43206}
ALSA: ctxfi: Limit PTP to a single page {CVE-2026-31602}
netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() {CVE-2026-43450}
smb: client: reject userspace cifs.spnego descriptions
ALSA: caiaq: fix stack out-of-bounds read in init_card {CVE-2026-31778}

Record: CLSA-2026-1780132980
Updated: 2026-11-02

OSVSUSE-SU-2025:21040-1No score