Linux i915 GPU kernel driver: A use-after-free in the i915 GPU kernel driver. The general shape is that a GPU object is

Impact

A use-after-free in the i915 GPU kernel driver. The general shape is that a GPU object is freed on one path while another path still holds a reference to it, so a local user with GPU access can get the kernel to read or write freed memory. Exploitability varies by heap layout, but on a GPU node every such bug is reachable from inside a container that was granted /dev/dri - the same boundary that is supposed to separate tenants. Specific trigger: revocation of fence registers racing with their use, leaving a dangling fence.

Who can reach it

Any local user or container with a DRM render node - i.e. any tenant that was scheduled a GPU. No privileged capability needed.

What to do

Fix ships in the Linux kernel. Update the kernel and reboot the node - in practice this is a drain plus reboot because the accelerator driver cannot be unloaded while jobs hold device file descriptors. No BIOS or firmware update needed.

References