{"api_version":"1","generated_at":"2026-08-11T12:22:10+00:00","cve":"CVE-2023-53087","urls":{"html":"https://cve.report/CVE-2023-53087","api":"https://cve.report/api/cve/CVE-2023-53087.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2023-53087","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2023-53087"},"summary":{"title":"drm/i915/active: Fix misuse of non-idle barriers as fence trackers","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/active: Fix misuse of non-idle barriers as fence trackers\n\nUsers reported oopses on list corruptions when using i915 perf with a\nnumber of concurrently running graphics applications.  Root cause analysis\npointed at an issue in barrier processing code -- a race among perf open /\nclose replacing active barriers with perf requests on kernel context and\nconcurrent barrier preallocate / acquire operations performed during user\ncontext first pin / last unpin.\n\nWhen adding a request to a composite tracker, we try to reuse an existing\nfence tracker, already allocated and registered with that composite.  The\ntracker we obtain may already track another fence, may be an idle barrier,\nor an active barrier.\n\nIf the tracker we get occurs a non-idle barrier then we try to delete that\nbarrier from a list of barrier tasks it belongs to.  However, while doing\nthat we don't respect return value from a function that performs the\nbarrier deletion.  Should the deletion ever fail, we would end up reusing\nthe tracker still registered as a barrier task.  Since the same structure\nfield is reused with both fence callback lists and barrier tasks list,\nlist corruptions would likely occur.\n\nBarriers are now deleted from a barrier tasks list by temporarily removing\nthe list content, traversing that content with skip over the node to be\ndeleted, then populating the list back with the modified content.  Should\nthat intentionally racy concurrent deletion attempts be not serialized,\none or more of those may fail because of the list being temporary empty.\n\nRelated code that ignores the results of barrier deletion was initially\nintroduced in v5.4 by commit d8af05ff38ae (\"drm/i915: Allow sharing the\nidle-barrier from other kernel requests\").  However, all users of the\nbarrier deletion routine were apparently serialized at that time, then the\nissue didn't exhibit itself.  Results of git bisect with help of a newly\ndeveloped igt@gem_barrier_race@remote-request IGT test indicate that list\ncorruptions might start to appear after commit 311770173fac (\"drm/i915/gt:\nSchedule request retirement when timeline idles\"), introduced in v5.5.\n\nRespect results of barrier deletion attempts -- mark the barrier as idle\nonly if successfully deleted from the list.  Then, before proceeding with\nsetting our fence as the one currently tracked, make sure that the tracker\nwe've got is not a non-idle barrier.  If that check fails then don't use\nthat tracker but go back and try to acquire a new, usable one.\n\nv3: use unlikely() to document what outcome we expect (Andi),\n  - fix bad grammar in commit description.\nv2: no code changes,\n  - blame commit 311770173fac (\"drm/i915/gt: Schedule request retirement\n    when timeline idles\"), v5.5, not commit d8af05ff38ae (\"drm/i915: Allow\n    sharing the idle-barrier from other kernel requests\"), v5.4,\n  - reword commit description.\n\n(cherry picked from commit 506006055769b10d1b2b4e22f636f3b45e0e9fc7)","state":"PUBLISHED","assigner":"Linux","published_at":"2025-05-02 16:15:27","updated_at":"2026-08-04 10:18:54"},"problem_types":["NVD-CWE-noinfo"],"metrics":[{"version":"3.1","source":"nvd@nist.gov","type":"Primary","score":"5.5","severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"}},{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/5e784a7d07af42057c0576fb647b482f4cb0dc2c","name":"https://git.kernel.org/stable/c/5e784a7d07af42057c0576fb647b482f4cb0dc2c","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/e0e6b416b25ee14716f3549e0cbec1011b193809","name":"https://git.kernel.org/stable/c/e0e6b416b25ee14716f3549e0cbec1011b193809","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/5c7591b8574c52c56b3994c2fbef1a3a311b5715","name":"https://git.kernel.org/stable/c/5c7591b8574c52c56b3994c2fbef1a3a311b5715","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/9159db27fb19bbf1c91b5c9d5285e66cc96cc5ff","name":"https://git.kernel.org/stable/c/9159db27fb19bbf1c91b5c9d5285e66cc96cc5ff","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/6ab7d33617559cced63d467928f478ea5c459021","name":"https://git.kernel.org/stable/c/6ab7d33617559cced63d467928f478ea5c459021","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-53087","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-53087","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 311770173fac27845a3a83e2c16100a54d308f72 5e784a7d07af42057c0576fb647b482f4cb0dc2c git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 311770173fac27845a3a83e2c16100a54d308f72 6ab7d33617559cced63d467928f478ea5c459021 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 311770173fac27845a3a83e2c16100a54d308f72 5c7591b8574c52c56b3994c2fbef1a3a311b5715 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 311770173fac27845a3a83e2c16100a54d308f72 9159db27fb19bbf1c91b5c9d5285e66cc96cc5ff git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 311770173fac27845a3a83e2c16100a54d308f72 e0e6b416b25ee14716f3549e0cbec1011b193809 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.5","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.5 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.10.176 5.10.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.15.104 5.15.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.1.21 6.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.2.8 6.2.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.3 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2023","cve_id":"53087","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"linux","cpe5":"linux_kernel","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/i915/i915_active.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"5e784a7d07af42057c0576fb647b482f4cb0dc2c","status":"affected","version":"311770173fac27845a3a83e2c16100a54d308f72","versionType":"git"},{"lessThan":"6ab7d33617559cced63d467928f478ea5c459021","status":"affected","version":"311770173fac27845a3a83e2c16100a54d308f72","versionType":"git"},{"lessThan":"5c7591b8574c52c56b3994c2fbef1a3a311b5715","status":"affected","version":"311770173fac27845a3a83e2c16100a54d308f72","versionType":"git"},{"lessThan":"9159db27fb19bbf1c91b5c9d5285e66cc96cc5ff","status":"affected","version":"311770173fac27845a3a83e2c16100a54d308f72","versionType":"git"},{"lessThan":"e0e6b416b25ee14716f3549e0cbec1011b193809","status":"affected","version":"311770173fac27845a3a83e2c16100a54d308f72","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpu/drm/i915/i915_active.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.5"},{"lessThan":"5.5","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.176","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.104","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.21","versionType":"semver"},{"lessThanOrEqual":"6.2.*","status":"unaffected","version":"6.2.8","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.3","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.10.176","versionStartIncluding":"5.5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.15.104","versionStartIncluding":"5.5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.21","versionStartIncluding":"5.5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.2.8","versionStartIncluding":"5.5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.3","versionStartIncluding":"5.5","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/active: Fix misuse of non-idle barriers as fence trackers\n\nUsers reported oopses on list corruptions when using i915 perf with a\nnumber of concurrently running graphics applications.  Root cause analysis\npointed at an issue in barrier processing code -- a race among perf open /\nclose replacing active barriers with perf requests on kernel context and\nconcurrent barrier preallocate / acquire operations performed during user\ncontext first pin / last unpin.\n\nWhen adding a request to a composite tracker, we try to reuse an existing\nfence tracker, already allocated and registered with that composite.  The\ntracker we obtain may already track another fence, may be an idle barrier,\nor an active barrier.\n\nIf the tracker we get occurs a non-idle barrier then we try to delete that\nbarrier from a list of barrier tasks it belongs to.  However, while doing\nthat we don't respect return value from a function that performs the\nbarrier deletion.  Should the deletion ever fail, we would end up reusing\nthe tracker still registered as a barrier task.  Since the same structure\nfield is reused with both fence callback lists and barrier tasks list,\nlist corruptions would likely occur.\n\nBarriers are now deleted from a barrier tasks list by temporarily removing\nthe list content, traversing that content with skip over the node to be\ndeleted, then populating the list back with the modified content.  Should\nthat intentionally racy concurrent deletion attempts be not serialized,\none or more of those may fail because of the list being temporary empty.\n\nRelated code that ignores the results of barrier deletion was initially\nintroduced in v5.4 by commit d8af05ff38ae (\"drm/i915: Allow sharing the\nidle-barrier from other kernel requests\").  However, all users of the\nbarrier deletion routine were apparently serialized at that time, then the\nissue didn't exhibit itself.  Results of git bisect with help of a newly\ndeveloped igt@gem_barrier_race@remote-request IGT test indicate that list\ncorruptions might start to appear after commit 311770173fac (\"drm/i915/gt:\nSchedule request retirement when timeline idles\"), introduced in v5.5.\n\nRespect results of barrier deletion attempts -- mark the barrier as idle\nonly if successfully deleted from the list.  Then, before proceeding with\nsetting our fence as the one currently tracked, make sure that the tracker\nwe've got is not a non-idle barrier.  If that check fails then don't use\nthat tracker but go back and try to acquire a new, usable one.\n\nv3: use unlikely() to document what outcome we expect (Andi),\n  - fix bad grammar in commit description.\nv2: no code changes,\n  - blame commit 311770173fac (\"drm/i915/gt: Schedule request retirement\n    when timeline idles\"), v5.5, not commit d8af05ff38ae (\"drm/i915: Allow\n    sharing the idle-barrier from other kernel requests\"), v5.4,\n  - reword commit description.\n\n(cherry picked from commit 506006055769b10d1b2b4e22f636f3b45e0e9fc7)"}],"metrics":[{"cvssV3_1":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"providerMetadata":{"dateUpdated":"2026-08-04T09:13:21.876Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/5e784a7d07af42057c0576fb647b482f4cb0dc2c"},{"url":"https://git.kernel.org/stable/c/6ab7d33617559cced63d467928f478ea5c459021"},{"url":"https://git.kernel.org/stable/c/5c7591b8574c52c56b3994c2fbef1a3a311b5715"},{"url":"https://git.kernel.org/stable/c/9159db27fb19bbf1c91b5c9d5285e66cc96cc5ff"},{"url":"https://git.kernel.org/stable/c/e0e6b416b25ee14716f3549e0cbec1011b193809"}],"title":"drm/i915/active: Fix misuse of non-idle barriers as fence trackers","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2023-53087","datePublished":"2025-05-02T15:55:34.204Z","dateReserved":"2025-05-02T15:51:43.551Z","dateUpdated":"2026-08-04T09:13:21.876Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2025-05-02 16:15:27","lastModifiedDate":"2026-08-04 10:18:54","problem_types":["NVD-CWE-noinfo"],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.5","versionEndExcluding":"5.10.176","matchCriteriaId":"7DA7FEF3-FE10-4D78-94E4-BDCDA7371DD5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"5.15.104","matchCriteriaId":"EB8A3D70-3EE1-4B1C-8A21-21CA7356DCA7"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.16","versionEndExcluding":"6.1.21","matchCriteriaId":"1F1CA6A9-8F4D-408D-9116-868EC067DCD9"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.2.8","matchCriteriaId":"4011EC6B-7786-4709-B765-186FA31D6F7F"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.3:rc1:*:*:*:*:*:*","matchCriteriaId":"B8E3B0E8-FA27-4305-87BB-AF6C25B160CB"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.3:rc2:*:*:*:*:*:*","matchCriteriaId":"A47F0FC3-CE52-4BA1-BA51-22F783938431"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2023","CveId":"53087","Ordinal":"1","Title":"drm/i915/active: Fix misuse of non-idle barriers as fence tracke","CVE":"CVE-2023-53087","Year":"2023"},"notes":[{"CveYear":"2023","CveId":"53087","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/active: Fix misuse of non-idle barriers as fence trackers\n\nUsers reported oopses on list corruptions when using i915 perf with a\nnumber of concurrently running graphics applications.  Root cause analysis\npointed at an issue in barrier processing code -- a race among perf open /\nclose replacing active barriers with perf requests on kernel context and\nconcurrent barrier preallocate / acquire operations performed during user\ncontext first pin / last unpin.\n\nWhen adding a request to a composite tracker, we try to reuse an existing\nfence tracker, already allocated and registered with that composite.  The\ntracker we obtain may already track another fence, may be an idle barrier,\nor an active barrier.\n\nIf the tracker we get occurs a non-idle barrier then we try to delete that\nbarrier from a list of barrier tasks it belongs to.  However, while doing\nthat we don't respect return value from a function that performs the\nbarrier deletion.  Should the deletion ever fail, we would end up reusing\nthe tracker still registered as a barrier task.  Since the same structure\nfield is reused with both fence callback lists and barrier tasks list,\nlist corruptions would likely occur.\n\nBarriers are now deleted from a barrier tasks list by temporarily removing\nthe list content, traversing that content with skip over the node to be\ndeleted, then populating the list back with the modified content.  Should\nthat intentionally racy concurrent deletion attempts be not serialized,\none or more of those may fail because of the list being temporary empty.\n\nRelated code that ignores the results of barrier deletion was initially\nintroduced in v5.4 by commit d8af05ff38ae (\"drm/i915: Allow sharing the\nidle-barrier from other kernel requests\").  However, all users of the\nbarrier deletion routine were apparently serialized at that time, then the\nissue didn't exhibit itself.  Results of git bisect with help of a newly\ndeveloped igt@gem_barrier_race@remote-request IGT test indicate that list\ncorruptions might start to appear after commit 311770173fac (\"drm/i915/gt:\nSchedule request retirement when timeline idles\"), introduced in v5.5.\n\nRespect results of barrier deletion attempts -- mark the barrier as idle\nonly if successfully deleted from the list.  Then, before proceeding with\nsetting our fence as the one currently tracked, make sure that the tracker\nwe've got is not a non-idle barrier.  If that check fails then don't use\nthat tracker but go back and try to acquire a new, usable one.\n\nv3: use unlikely() to document what outcome we expect (Andi),\n  - fix bad grammar in commit description.\nv2: no code changes,\n  - blame commit 311770173fac (\"drm/i915/gt: Schedule request retirement\n    when timeline idles\"), v5.5, not commit d8af05ff38ae (\"drm/i915: Allow\n    sharing the idle-barrier from other kernel requests\"), v5.4,\n  - reword commit description.\n\n(cherry picked from commit 506006055769b10d1b2b4e22f636f3b45e0e9fc7)","Type":"Description","Title":"drm/i915/active: Fix misuse of non-idle barriers as fence tracke"}]}}}