GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2023-53646 (GCVE-0-2023-53646)

Vulnerability from cvelistv5 – Published: 2025-10-07 15:19 – Updated: 2026-08-05 09:15
VLAI
Title
drm/i915/perf: add sentinel to xehp_oa_b_counters
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/i915/perf: add sentinel to xehp_oa_b_counters Arrays passed to reg_in_range_table should end with empty record. The patch solves KASAN detected bug with signature: BUG: KASAN: global-out-of-bounds in xehp_is_valid_b_counter_addr+0x2c7/0x350 [i915] Read of size 4 at addr ffffffffa1555d90 by task perf/1518 CPU: 4 PID: 1518 Comm: perf Tainted: G U 6.4.0-kasan_438-g3303d06107f3+ #1 Hardware name: Intel Corporation Meteor Lake Client Platform/MTL-P DDR5 SODIMM SBS RVP, BIOS MTLPFWI1.R00.3223.D80.2305311348 05/31/2023 Call Trace: <TASK> ... xehp_is_valid_b_counter_addr+0x2c7/0x350 [i915] (cherry picked from commit 2f42c5afb34b5696cf5fe79e744f99be9b218798)
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 0fa9349dda030fa847b36f880a5eea25c3202b66 , < 21d92025e80629fd5c25cd6751f8cf38c784dd4a (git)
Affected: 0fa9349dda030fa847b36f880a5eea25c3202b66 , < 785b3f667b4bf98804cad135005e964df0c750de (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.2
Unaffected: 0 , < 6.2 (semver)
Unaffected: 6.4.7 , ≤ 6.4.* (semver)
Unaffected: 6.5 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/i915/i915_perf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "21d92025e80629fd5c25cd6751f8cf38c784dd4a",
              "status": "affected",
              "version": "0fa9349dda030fa847b36f880a5eea25c3202b66",
              "versionType": "git"
            },
            {
              "lessThan": "785b3f667b4bf98804cad135005e964df0c750de",
              "status": "affected",
              "version": "0fa9349dda030fa847b36f880a5eea25c3202b66",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/i915/i915_perf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.4.*",
              "status": "unaffected",
              "version": "6.4.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.5",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4.7",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.5",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/perf: add sentinel to xehp_oa_b_counters\n\nArrays passed to reg_in_range_table should end with empty record.\n\nThe patch solves KASAN detected bug with signature:\nBUG: KASAN: global-out-of-bounds in xehp_is_valid_b_counter_addr+0x2c7/0x350 [i915]\nRead of size 4 at addr ffffffffa1555d90 by task perf/1518\n\nCPU: 4 PID: 1518 Comm: perf Tainted: G U 6.4.0-kasan_438-g3303d06107f3+ #1\nHardware name: Intel Corporation Meteor Lake Client Platform/MTL-P DDR5 SODIMM SBS RVP, BIOS MTLPFWI1.R00.3223.D80.2305311348 05/31/2023\nCall Trace:\n\u003cTASK\u003e\n...\nxehp_is_valid_b_counter_addr+0x2c7/0x350 [i915]\n\n(cherry picked from commit 2f42c5afb34b5696cf5fe79e744f99be9b218798)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached only through the DRM_IOCTL_I915_PERF_ADD_CONFIG ioctl on a local i915 device/render node (/dev/dri/renderD128), requiring local system access. There is no network-facing path to i915 perf configuration.\nAC:L - A single ioctl carrying any 32-bit register address outside the two in-bounds ranges deterministically drives the sentinel-less loop past the end of the 16-byte array; no race, timing, or memory-layout luck is needed to trigger the out-of-bounds access.\nPR:L - The ioctl is DRM_RENDER_ALLOW, so no DRM master or authentication is required \u2014 only an open render node, which is group/world accessible on typical desktop, Android and container deployments. On the widely used profiling configuration dev.i915.perf_stream_paranoid=0 (the documented setting for unprivileged Intel GPU metrics collection) the perfmon_capable() check is bypassed entirely, leaving an ordinary unprivileged user able to reach the bug.\nUI:N - The attacker triggers the flaw entirely on their own by issuing the ioctl from their own process; no victim action, file open, or mount is involved.\nS:U - The out-of-bounds read and the resulting register-allowlist bypass occur within the kernel\u0027s own security authority on the same host; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The walk reads kernel module .rodata past the object bounds with no bound other than encountering a zero pair, and the function\u0027s boolean result is returned to userspace as an accept/reject oracle, letting an attacker probe addresses and reconstruct the contents of the out-of-bounds kernel memory.\nI:H - The OOB data is interpreted as additional whitelist ranges, so registers that were never meant to be programmable are accepted and then emitted as MI_LOAD_REGISTER_IMM in a kernel-built batch executed unfiltered by the GPU command streamer, giving attacker-controlled 32-bit writes to non-whitelisted GPU MMIO and defeating the very allowlist this code enforces.\nA:H - The unterminated walk can run into unmapped module memory and oops, and it reliably panics kernels built with KASAN (the reported crash signature) or configured with kasan.fault=panic/panic_on_warn; additionally, programming out-of-allowlist GPU registers can hang or wedge the GPU for all users."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:15:21.134Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/21d92025e80629fd5c25cd6751f8cf38c784dd4a"
        },
        {
          "url": "https://git.kernel.org/stable/c/785b3f667b4bf98804cad135005e964df0c750de"
        }
      ],
      "title": "drm/i915/perf: add sentinel to xehp_oa_b_counters",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53646",
    "datePublished": "2025-10-07T15:19:44.412Z",
    "dateReserved": "2025-10-07T15:16:59.659Z",
    "dateUpdated": "2026-08-05T09:15:21.134Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-53646",
      "date": "2026-09-15",
      "epss": "0.00196",
      "percentile": "0.09539"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-53646\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-10-07T16:15:48.017\",\"lastModified\":\"2026-08-04T10:19:16.313\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/i915/perf: add sentinel to xehp_oa_b_counters\\n\\nArrays passed to reg_in_range_table should end with empty record.\\n\\nThe patch solves KASAN detected bug with signature:\\nBUG: KASAN: global-out-of-bounds in xehp_is_valid_b_counter_addr+0x2c7/0x350 [i915]\\nRead of size 4 at addr ffffffffa1555d90 by task perf/1518\\n\\nCPU: 4 PID: 1518 Comm: perf Tainted: G U 6.4.0-kasan_438-g3303d06107f3+ #1\\nHardware name: Intel Corporation Meteor Lake Client Platform/MTL-P DDR5 SODIMM SBS RVP, BIOS MTLPFWI1.R00.3223.D80.2305311348 05/31/2023\\nCall Trace:\\n\u003cTASK\u003e\\n...\\nxehp_is_valid_b_counter_addr+0x2c7/0x350 [i915]\\n\\n(cherry picked from commit 2f42c5afb34b5696cf5fe79e744f99be9b218798)\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/i915/i915_perf.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"0fa9349dda030fa847b36f880a5eea25c3202b66\",\"lessThan\":\"21d92025e80629fd5c25cd6751f8cf38c784dd4a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0fa9349dda030fa847b36f880a5eea25c3202b66\",\"lessThan\":\"785b3f667b4bf98804cad135005e964df0c750de\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/i915/i915_perf.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.2\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.2\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.4.7\",\"lessThanOrEqual\":\"6.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.5\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.4.7\",\"matchCriteriaId\":\"60A1A1ED-EA6C-42F6-80D3-3316DC7608C7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.5:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"0B3E6E4D-E24E-4630-B00C-8C9901C597B0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.5:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"E4A01A71-0F09-4DB2-A02F-7EFFBE27C98D\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/21d92025e80629fd5c25cd6751f8cf38c784dd4a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/785b3f667b4bf98804cad135005e964df0c750de\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:16:21+00:00",
      "cve": "CVE-2023-53646",
      "id": "CVE-2023-53646",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:fixed": "399",
      "product_status:known_affected": "38",
      "product_status:known_not_affected": "118",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/i915/perf: add sentinel to xehp_oa_b_counters",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-53646.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-07T16:45:01Z",
      "cve": "CVE-2023-53646",
      "id": "CVE-2023-53646",
      "initial_release_date": "2025-10-08T23:30:46Z",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "393",
      "product_status:recommended": "359",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-53646",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-53646.json",
      "version": "42"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.