CVE-2025-68207 (GCVE-0-2025-68207)

Vulnerability from cvelistv5 – Published: 2025-12-16 13:48 – Updated: 2026-08-05 12:10
VLAI
Title
drm/xe/guc: Synchronize Dead CT worker with unbind
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/xe/guc: Synchronize Dead CT worker with unbind Cancel and wait for any Dead CT worker to complete before continuing with device unbinding. Else the worker will end up using resources freed by the undind operation. (cherry picked from commit 492671339114e376aaa38626d637a2751cdef263)
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: ff6482fb458953e111a82b7c537363d9aacf04bf , < 35959ab7d16b618616edf6df882a4533d2efe193 (git)
Affected: d2c5a5a926f43b2e42c5c955f917bad8ad6dd68c , < ce6ccf8e881a919bf902174ac879f80c97669498 (git)
Affected: d2c5a5a926f43b2e42c5c955f917bad8ad6dd68c , < 95af8f4fdce8349a5fe75264007f1af2aa1082ea (git)
Affected: 6.12.37 , < 6.12.59 (semver)
Create a notification for this product.
Linux Linux Affected: 6.13
Unaffected: 0 , < 6.13 (semver)
Unaffected: 6.12.59 , ≤ 6.12.* (semver)
Unaffected: 6.17.9 , ≤ 6.17.* (semver)
Unaffected: 6.18 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/xe/xe_guc_ct.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "35959ab7d16b618616edf6df882a4533d2efe193",
              "status": "affected",
              "version": "ff6482fb458953e111a82b7c537363d9aacf04bf",
              "versionType": "git"
            },
            {
              "lessThan": "ce6ccf8e881a919bf902174ac879f80c97669498",
              "status": "affected",
              "version": "d2c5a5a926f43b2e42c5c955f917bad8ad6dd68c",
              "versionType": "git"
            },
            {
              "lessThan": "95af8f4fdce8349a5fe75264007f1af2aa1082ea",
              "status": "affected",
              "version": "d2c5a5a926f43b2e42c5c955f917bad8ad6dd68c",
              "versionType": "git"
            },
            {
              "lessThan": "6.12.59",
              "status": "affected",
              "version": "6.12.37",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/xe/xe_guc_ct.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "lessThan": "6.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.59",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.59",
                  "versionStartIncluding": "6.12.37",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.9",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/guc: Synchronize Dead CT worker with unbind\n\nCancel and wait for any Dead CT worker to complete before continuing\nwith device unbinding. Else the worker will end up using resources freed\nby the undind operation.\n\n(cherry picked from commit 492671339114e376aaa38626d637a2751cdef263)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Triggering uses local Xe render-device ioctls and local device-lifetime teardown, not network or adjacent packet processing.\nAC:L - On an affected CONFIG_DRM_XE_DEBUG build, an attacker can flood recoverable GPU faults to queue the worker and retain or release the final render-device reference to align it with teardown. Automated device or VF teardown makes repeated attempts practical.\nPR:L - The required Xe VM, VM_BIND, execution-queue, and execution ioctls are DRM_RENDER_ALLOW and require no capability, DRM-master status, or init-namespace privilege; ordinary render-node access suffices.\nUI:N - No victim must open or process attacker-controlled content, and device or VF teardown can occur automatically as part of its managed lifecycle.\nS:U - The use-after-free compromises resources within the same host-kernel security authority and does not inherently cross a VM, IOMMU, or other security boundary.\nC:H - The worker dereferences released Xe device, GT, and snapshot structures and prints snapshot data; heap reuse can turn its stale pointer traversal into disclosure of arbitrary kernel memory.\nI:H - The worker writes into the freed Dead-CT object and frees nested snapshot pointers obtained from it, providing exploitable arbitrary-free and heap-corruption behavior that can enable control-flow hijacking.\nA:H - Stale dereferences, locking through freed memory, and invalid or attacker-influenced frees can cause a kernel oops, panic, or hang."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:10:12.784Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/35959ab7d16b618616edf6df882a4533d2efe193"
        },
        {
          "url": "https://git.kernel.org/stable/c/ce6ccf8e881a919bf902174ac879f80c97669498"
        },
        {
          "url": "https://git.kernel.org/stable/c/95af8f4fdce8349a5fe75264007f1af2aa1082ea"
        }
      ],
      "title": "drm/xe/guc: Synchronize Dead CT worker with unbind",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-68207",
    "datePublished": "2025-12-16T13:48:34.574Z",
    "dateReserved": "2025-12-16T13:41:40.255Z",
    "dateUpdated": "2026-08-05T12:10:12.784Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-68207",
      "date": "2026-08-07",
      "epss": "0.00135",
      "percentile": "0.03395"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-68207\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-16T14:15:53.590\",\"lastModified\":\"2026-07-30T06:24:33.380\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/xe/guc: Synchronize Dead CT worker with unbind\\n\\nCancel and wait for any Dead CT worker to complete before continuing\\nwith device unbinding. Else the worker will end up using resources freed\\nby the undind operation.\\n\\n(cherry picked from commit 492671339114e376aaa38626d637a2751cdef263)\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/xe/xe_guc_ct.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"ff6482fb458953e111a82b7c537363d9aacf04bf\",\"lessThan\":\"35959ab7d16b618616edf6df882a4533d2efe193\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d2c5a5a926f43b2e42c5c955f917bad8ad6dd68c\",\"lessThan\":\"ce6ccf8e881a919bf902174ac879f80c97669498\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d2c5a5a926f43b2e42c5c955f917bad8ad6dd68c\",\"lessThan\":\"95af8f4fdce8349a5fe75264007f1af2aa1082ea\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6.12.37\",\"lessThan\":\"6.12.59\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/xe/xe_guc_ct.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.13\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.13\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.59\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17.9\",\"lessThanOrEqual\":\"6.17.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/35959ab7d16b618616edf6df882a4533d2efe193\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/95af8f4fdce8349a5fe75264007f1af2aa1082ea\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ce6ccf8e881a919bf902174ac879f80c97669498\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-07-30T10:07:27+00:00",
      "cve": "CVE-2025-68207",
      "id": "CVE-2025-68207",
      "initial_release_date": "2025-12-16T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/xe/guc: Synchronize Dead CT worker with unbind",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-68207.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-31T00:58:54Z",
      "cve": "CVE-2025-68207",
      "id": "CVE-2025-68207",
      "initial_release_date": "2025-12-17T00:25:28Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "358",
      "product_status:recommended": "283",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-68207",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-68207.json",
      "version": "24"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.