Riskcovery

CVE-2025-68193

drm/xe/guc: Add devm release action to safely tear down CT

State
Published
Severity
Not scored
Published
Dec 16, 2025
Updated
Oct 21, 2026
Reserved
Dec 16, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/xe/guc: Add devm release action to safely tear down CT

When a buffer object (BO) is allocated with the XE_BO_FLAG_GGTT_INVALIDATE flag, the driver initiates TLB invalidation requests via the CTB mechanism while releasing the BO. However a premature release of the CTB BO can lead to system crashes, as observed in:

Oops: Oops: 0000 [#1] SMP NOPTI RIP: 0010:h2g_write+0x2f3/0x7c0 [xe] Call Trace: guc_ct_send_locked+0x8b/0x670 [xe] xe_guc_ct_send_locked+0x19/0x60 [xe] send_tlb_invalidation+0xb4/0x460 [xe] xe_gt_tlb_invalidation_ggtt+0x15e/0x2e0 [xe] ggtt_invalidate_gt_tlb.part.0+0x16/0x90 [xe] ggtt_node_remove+0x110/0x140 [xe] xe_ggtt_node_remove+0x40/0xa0 [xe] xe_ggtt_remove_bo+0x87/0x250 [xe]

Introduce a devm-managed release action during xe_guc_ct_init() and xe_guc_ct_init_post_hwconfig() to ensure proper CTB disablement before resource deallocation, preventing the use-after-free scenario.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 231c4110873a5db4975512c30aa10edcc5be56e2 to before fd4e41545d5955e6f7b4a0c4b56d21010ce8e812Affected
  • 231c4110873a5db4975512c30aa10edcc5be56e2 to before 52faa05fcd9f78af99abebe30a4b7b444744c991Affected
  • 231c4110873a5db4975512c30aa10edcc5be56e2 to before ee4b32220a6b41e71512e8804585325e685456baAffected
LinuxLinux
  • 6.10Affected
  • before 6.10Not affected
  • 6.12.114 through 6.12.*Not affected
  • 6.17.8 through 6.17.*Not affected
  • 6.18 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.