CVE-2026-68382 (GCVE-0-2026-68382)

Vulnerability from cvelistv5 – Published: 2026-08-10 12:04 – Updated: 2026-08-17 05:04
VLAI
Title
drm/xe/guc: Hold device ref until queue teardown completes
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/xe/guc: Hold device ref until queue teardown completes GuC exec queue destruction can run asynchronously. If the final device put happens from a destroy worker, drmm cleanup can end up draining the same workqueue and deadlock. Hold a drm_device reference for the queue lifetime and drop it after queue teardown completes. This keeps drmm cleanup from running while async destroy work is still pending. Move GuC destroy work to a module-lifetime Xe workqueue and flush it on PCI remove so hot-unbind/rebind still waits for pending destroy work. With queue-held device refs, guc_submit_sw_fini() cannot run with live GuC IDs. Replace the fini wait with an assertion and remove the unused fini_wq. v2: - Rebase v3: - Switch to queue-lifetime drm_dev_get()/drm_dev_put() model. (Matt) - Queue async teardown on system_dfl_wq instead of xe->destroy_wq. (Matt) - Drop separate deferred drm_dev_put worker. - Remove stale drain_workqueue(xe->destroy_wq) from guc_submit_sw_fini(). v4: - Replace the guc_submit_sw_fini() wait with an assertion and remove the now-unused fini_wq. (sashiko) v5: - Move destroy work to a module-lifetime Xe workqueue instead of system_dfl_wq. (Matt) - Flush the module-lifetime destroy workqueue during PCI remove to preserve the old device-remove wait semantics. v6: - Keep SVM pagemap destroy work on the per-device destroy_wq to avoid letting it outlive the xe_device/drm_device. (Sashiko) - Use WQ_MEM_RECLAIM for xe->destroy_wq because SVM pagemap destroy work can be queued from the reclaim path. v7: - Drop the per-device xe->destroy_wq and use the module-level destroy WQ for SVM pagemap destroy as well. (Matt) - Rename xe_exec_queue_destroy_wq_*() helpers to xe_destroy_wq_*() helpers because the WQ is no longer exec-queue specific. (Matt) v8: - Rebase. v9: - Keep SVM pagemap destroy work on the per-device WQ_MEM_RECLAIM destroy_wq because it can be queued from reclaim and embeds the dev_pagemap used by devres teardown. (Sashiko) - Keep the module-level destroy WQ GuC-only and drop WQ_MEM_RECLAIM from it. - Update the module-WQ kdoc to document the GuC/SVM split. v10: - Keep xe->destroy_wq per-cpu while adding WQ_MEM_RECLAIM to fix the workqueue allocation warning. v11: - Drop the SVM pagemap destroy comment as it was revision-specific. (Thomas) v12: - Rebase. (cherry picked from commit da1124abac689cc2b1d8995e5f0a816f8a122edb)
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 2d2be279f1ca9e7288282d4214f16eea8a727cdb , < 03d6f83979b0d75a0b0893dfe1735ec93facf515 (git)
Affected: 2d2be279f1ca9e7288282d4214f16eea8a727cdb , < 9b7e60184f4b22e893d4ae95234d5f26261a430c (git)
Affected: 272b0e78874586d6ccae04079d75b27b47705544 (git)
Affected: 421c74670b0f9d5c007f1276d3647aa58f407fde (git)
Affected: 6.10.14 , < 6.11 (semver)
Affected: 6.11.3 , < 6.12 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.12
Unaffected: 0 , < 6.12 (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/xe/xe_device.c",
            "drivers/gpu/drm/xe/xe_device_types.h",
            "drivers/gpu/drm/xe/xe_guc_submit.c",
            "drivers/gpu/drm/xe/xe_guc_types.h",
            "drivers/gpu/drm/xe/xe_module.c",
            "drivers/gpu/drm/xe/xe_module.h",
            "drivers/gpu/drm/xe/xe_pci.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "03d6f83979b0d75a0b0893dfe1735ec93facf515",
              "status": "affected",
              "version": "2d2be279f1ca9e7288282d4214f16eea8a727cdb",
              "versionType": "git"
            },
            {
              "lessThan": "9b7e60184f4b22e893d4ae95234d5f26261a430c",
              "status": "affected",
              "version": "2d2be279f1ca9e7288282d4214f16eea8a727cdb",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "272b0e78874586d6ccae04079d75b27b47705544",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "421c74670b0f9d5c007f1276d3647aa58f407fde",
              "versionType": "git"
            },
            {
              "lessThan": "6.11",
              "status": "affected",
              "version": "6.10.14",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12",
              "status": "affected",
              "version": "6.11.3",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/xe/xe_device.c",
            "drivers/gpu/drm/xe/xe_device_types.h",
            "drivers/gpu/drm/xe/xe_guc_submit.c",
            "drivers/gpu/drm/xe/xe_guc_types.h",
            "drivers/gpu/drm/xe/xe_module.c",
            "drivers/gpu/drm/xe/xe_module.h",
            "drivers/gpu/drm/xe/xe_pci.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "lessThan": "6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.10.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.11.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/guc: Hold device ref until queue teardown completes\n\nGuC exec queue destruction can run asynchronously. If the final device\nput happens from a destroy worker, drmm cleanup can end up draining\nthe same workqueue and deadlock.\n\nHold a drm_device reference for the queue lifetime and drop it after\nqueue teardown completes. This keeps drmm cleanup from running while\nasync destroy work is still pending.\n\nMove GuC destroy work to a module-lifetime Xe workqueue and flush it\non PCI remove so hot-unbind/rebind still waits for pending destroy work.\n\nWith queue-held device refs, guc_submit_sw_fini() cannot run with live\nGuC IDs. Replace the fini wait with an assertion and remove the unused\nfini_wq.\n\nv2:\n  - Rebase\n\nv3:\n  - Switch to queue-lifetime drm_dev_get()/drm_dev_put() model. (Matt)\n  - Queue async teardown on system_dfl_wq instead of xe-\u003edestroy_wq. (Matt)\n  - Drop separate deferred drm_dev_put worker.\n  - Remove stale drain_workqueue(xe-\u003edestroy_wq) from guc_submit_sw_fini().\n\nv4:\n  - Replace the guc_submit_sw_fini() wait with an assertion and remove\n    the now-unused fini_wq. (sashiko)\n\nv5:\n  - Move destroy work to a module-lifetime Xe workqueue instead of\n    system_dfl_wq. (Matt)\n  - Flush the module-lifetime destroy workqueue during PCI remove to\n    preserve the old device-remove wait semantics.\n\nv6:\n  - Keep SVM pagemap destroy work on the per-device destroy_wq to avoid\n    letting it outlive the xe_device/drm_device. (Sashiko)\n  - Use WQ_MEM_RECLAIM for xe-\u003edestroy_wq because SVM pagemap destroy work\n    can be queued from the reclaim path.\n\nv7:\n  - Drop the per-device xe-\u003edestroy_wq and use the module-level destroy WQ\n    for SVM pagemap destroy as well. (Matt)\n  - Rename xe_exec_queue_destroy_wq_*() helpers to xe_destroy_wq_*()\n    helpers because the WQ is no longer exec-queue specific. (Matt)\n\nv8:\n  - Rebase.\n\nv9:\n  - Keep SVM pagemap destroy work on the per-device WQ_MEM_RECLAIM\n    destroy_wq because it can be queued from reclaim and embeds\n    the dev_pagemap used by devres teardown. (Sashiko)\n  - Keep the module-level destroy WQ GuC-only and drop WQ_MEM_RECLAIM\n    from it.\n  - Update the module-WQ kdoc to document the GuC/SVM split.\n\nv10:\n  - Keep xe-\u003edestroy_wq per-cpu while adding WQ_MEM_RECLAIM to fix the\n    workqueue allocation warning.\n\nv11:\n  - Drop the SVM pagemap destroy comment as it was revision-specific.\n    (Thomas)\n\nv12:\n  - Rebase.\n\n(cherry picked from commit da1124abac689cc2b1d8995e5f0a816f8a122edb)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable state is created through the Intel Xe DRM render node (/dev/dri/renderD*) via DRM_RENDER_ALLOW exec-queue create/destroy ioctls and manifests during local device teardown; no network or adjacent-network input is involved.\nAC:L - The attacker deterministically controls the decisive side of the race: GuC queue teardown blocks on a GuC deregister round-trip and cancel_delayed_work_sync() of the TDR, so long-running contexts with large preempt/job timeouts reliably keep exec_queue_lookup non-empty past guc_submit_sw_fini()\u0027s fixed 5s wait, and the attempt can be repeated freely.\nPR:L - Exec queue creation and destruction are DRM_RENDER_ALLOW ioctls reachable by any unprivileged user holding an open render node, which is granted to logged-in users by default udev/ACL rules on systems with Intel GPUs; no capability or root privilege is needed to leave destroy work pending.\nUI:N - The attacker acts entirely on its own through render-node ioctls and GPU submission; no victim must open a file, mount a filesystem, or take any other action for the stale teardown state to be created.\nS:U - The corruption is confined to kernel memory managed by the same security authority as the xe driver; there is no VM escape, IOMMU/DMA boundary bypass, or other crossing into a different security scope.\nC:H - After the 5s wait times out (the assert is a no-op on production builds), drm_dev_release() kfree()s the whole xe_device while destroy work is pending, so the worker dereferences a freed slab object; the attacker can spray the reclaimed allocation and read back kernel data through the stale xe/guc pointers and xarray.\nI:H - The pending worker writes through the freed xe_device \u2014 xa_erase() on the destroyed lookup, mutex operations on submission_state.lock, and xe_guc_id_mgr_release_locked() bitmap updates \u2014 giving controlled writes into a reclaimed heap object and a path to control-flow hijack.\nA:H - Use-after-free on the freed device structure reliably oopses or panics the kernel; additionally the drain_workqueue() from a work item on the same destroy workqueue self-deadlocks, hanging device removal indefinitely."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:04:28.645Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/03d6f83979b0d75a0b0893dfe1735ec93facf515"
        },
        {
          "url": "https://git.kernel.org/stable/c/9b7e60184f4b22e893d4ae95234d5f26261a430c"
        }
      ],
      "title": "drm/xe/guc: Hold device ref until queue teardown completes",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68382",
    "datePublished": "2026-08-10T12:04:01.187Z",
    "dateReserved": "2026-07-30T09:28:09.387Z",
    "dateUpdated": "2026-08-17T05:04:28.645Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68382",
      "date": "2026-08-20",
      "epss": "0.00129",
      "percentile": "0.03007"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-68382\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-10T13:20:31.343\",\"lastModified\":\"2026-08-17T06:17:46.683\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/xe/guc: Hold device ref until queue teardown completes\\n\\nGuC exec queue destruction can run asynchronously. If the final device\\nput happens from a destroy worker, drmm cleanup can end up draining\\nthe same workqueue and deadlock.\\n\\nHold a drm_device reference for the queue lifetime and drop it after\\nqueue teardown completes. This keeps drmm cleanup from running while\\nasync destroy work is still pending.\\n\\nMove GuC destroy work to a module-lifetime Xe workqueue and flush it\\non PCI remove so hot-unbind/rebind still waits for pending destroy work.\\n\\nWith queue-held device refs, guc_submit_sw_fini() cannot run with live\\nGuC IDs. Replace the fini wait with an assertion and remove the unused\\nfini_wq.\\n\\nv2:\\n  - Rebase\\n\\nv3:\\n  - Switch to queue-lifetime drm_dev_get()/drm_dev_put() model. (Matt)\\n  - Queue async teardown on system_dfl_wq instead of xe-\u003edestroy_wq. (Matt)\\n  - Drop separate deferred drm_dev_put worker.\\n  - Remove stale drain_workqueue(xe-\u003edestroy_wq) from guc_submit_sw_fini().\\n\\nv4:\\n  - Replace the guc_submit_sw_fini() wait with an assertion and remove\\n    the now-unused fini_wq. (sashiko)\\n\\nv5:\\n  - Move destroy work to a module-lifetime Xe workqueue instead of\\n    system_dfl_wq. (Matt)\\n  - Flush the module-lifetime destroy workqueue during PCI remove to\\n    preserve the old device-remove wait semantics.\\n\\nv6:\\n  - Keep SVM pagemap destroy work on the per-device destroy_wq to avoid\\n    letting it outlive the xe_device/drm_device. (Sashiko)\\n  - Use WQ_MEM_RECLAIM for xe-\u003edestroy_wq because SVM pagemap destroy work\\n    can be queued from the reclaim path.\\n\\nv7:\\n  - Drop the per-device xe-\u003edestroy_wq and use the module-level destroy WQ\\n    for SVM pagemap destroy as well. (Matt)\\n  - Rename xe_exec_queue_destroy_wq_*() helpers to xe_destroy_wq_*()\\n    helpers because the WQ is no longer exec-queue specific. (Matt)\\n\\nv8:\\n  - Rebase.\\n\\nv9:\\n  - Keep SVM pagemap destroy work on the per-device WQ_MEM_RECLAIM\\n    destroy_wq because it can be queued from reclaim and embeds\\n    the dev_pagemap used by devres teardown. (Sashiko)\\n  - Keep the module-level destroy WQ GuC-only and drop WQ_MEM_RECLAIM\\n    from it.\\n  - Update the module-WQ kdoc to document the GuC/SVM split.\\n\\nv10:\\n  - Keep xe-\u003edestroy_wq per-cpu while adding WQ_MEM_RECLAIM to fix the\\n    workqueue allocation warning.\\n\\nv11:\\n  - Drop the SVM pagemap destroy comment as it was revision-specific.\\n    (Thomas)\\n\\nv12:\\n  - Rebase.\\n\\n(cherry picked from commit da1124abac689cc2b1d8995e5f0a816f8a122edb)\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/xe/xe_device.c\",\"drivers/gpu/drm/xe/xe_device_types.h\",\"drivers/gpu/drm/xe/xe_guc_submit.c\",\"drivers/gpu/drm/xe/xe_guc_types.h\",\"drivers/gpu/drm/xe/xe_module.c\",\"drivers/gpu/drm/xe/xe_module.h\",\"drivers/gpu/drm/xe/xe_pci.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2d2be279f1ca9e7288282d4214f16eea8a727cdb\",\"lessThan\":\"03d6f83979b0d75a0b0893dfe1735ec93facf515\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2d2be279f1ca9e7288282d4214f16eea8a727cdb\",\"lessThan\":\"9b7e60184f4b22e893d4ae95234d5f26261a430c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"272b0e78874586d6ccae04079d75b27b47705544\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"421c74670b0f9d5c007f1276d3647aa58f407fde\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6.10.14\",\"lessThan\":\"6.11\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.11.3\",\"lessThan\":\"6.12\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/xe/xe_device.c\",\"drivers/gpu/drm/xe/xe_device_types.h\",\"drivers/gpu/drm/xe/xe_guc_submit.c\",\"drivers/gpu/drm/xe/xe_guc_types.h\",\"drivers/gpu/drm/xe/xe_module.c\",\"drivers/gpu/drm/xe/xe_module.h\",\"drivers/gpu/drm/xe/xe_pci.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.12\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.12\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.6\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/03d6f83979b0d75a0b0893dfe1735ec93facf515\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9b7e60184f4b22e893d4ae95234d5f26261a430c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-13T23:28:13+00:00",
      "cve": "CVE-2026-68382",
      "id": "CVE-2026-68382",
      "initial_release_date": "2026-08-10T00:00:00+00:00",
      "product_status:known_affected": "183",
      "product_status:known_not_affected": "93",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/xe/guc: Hold device ref until queue teardown completes",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68382.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-13T01:28:07Z",
      "cve": "CVE-2026-68382",
      "id": "CVE-2026-68382",
      "initial_release_date": "2026-08-12T16:22:27Z",
      "product_status:known_affected": "82",
      "product_status:known_not_affected": "214",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-68382",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-68382.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.