CVE-2025-37754

HuC delayed loading fence, introduced with commit 27536e03271da ("drm/i915/huc: track delayed HuC load with a fence"), is registered with object tracker early on driver probe but unregistered only from driver remove, which is not called on early probe errors. Since its memory is allocated under devres, then released anyway, it may happen to be allocated again to the fence and reused on future driver probes, resulting in kernel warnings that taint the kernel:

<4> [309.731371] ------------[ cut here ]------------ <3> [309.731373] ODEBUG: init destroyed (active state 0) object: ffff88813d7dd2e0 object type: i915swfence hint: swfencedummynotify+0x0/0x20 [i915] <4> [309.731575] WARNING: CPU: 2 PID: 3161 at lib/debugobjects.c:612 debugprintobject+0x93/0xf0 ... <4> [309.731693] CPU: 2 UID: 0 PID: 3161 Comm: i915moduleloa Tainted: G U 6.14.0-CIDRM16362-gf0fd77956987+ #1 ... <4> [309.731700] RIP: 0010:debugprintobject+0x93/0xf0 ... <4> [309.731728] Call Trace: <4> [309.731730] <TASK> ... <4> [309.731949] _debugobjectinit+0x17b/0x1c0 <4> [309.731957] debugobjectinit+0x34/0x50 <4> [309.732126] _i915swfenceinit+0x34/0x60 [i915] <4> [309.732256] intelhucinitearly+0x4b/0x1d0 [i915] <4> [309.732468] intelucinitearly+0x61/0x680 [i915] <4> [309.732667] intelgtcommoninitearly+0x105/0x130 [i915] <4> [309.732804] intelrootgtinitearly+0x63/0x80 [i915] <4> [309.732938] i915driverprobe+0x1fa/0xeb0 [i915] <4> [309.733075] i915pciprobe+0xe6/0x220 [i915] <4> [309.733198] localpciprobe+0x44/0xb0 <4> [309.733203] pcideviceprobe+0xf4/0x270 <4> [309.733209] reallyprobe+0xee/0x3c0 <4> [309.733215] _driverprobedevice+0x8c/0x180 <4> [309.733219] driverprobedevice+0x24/0xd0 <4> [309.733223] _driverattach+0x10f/0x220 <4> [309.733230] busforeachdev+0x7d/0xe0 <4> [309.733236] driverattach+0x1e/0x30 <4> [309.733239] busadddriver+0x151/0x290 <4> [309.733244] driverregister+0x5e/0x130 <4> [309.733247] _pciregisterdriver+0x7d/0x90 <4> [309.733251] i915pciregisterdriver+0x23/0x30 [i915] <4> [309.733413] i915init+0x34/0x120 [i915] <4> [309.733655] dooneinitcall+0x62/0x3f0 <4> [309.733667] doinitmodule+0x97/0x2a0 <4> [309.733671] loadmodule+0x25ff/0x2890 <4> [309.733688] initmodulefromfile+0x97/0xe0 <4> [309.733701] idempotentinitmodule+0x118/0x330 <4> [309.733711] _x64sysfinitmodule+0x77/0x100 <4> [309.733715] x64syscall+0x1f37/0x2650 <4> [309.733719] dosyscall64+0x91/0x180 <4> [309.733763] entrySYSCALL64afterhwframe+0x76/0x7e <4> [309.733792] </TASK> ... <4> [309.733806] ---[ end trace 0000000000000000 ]---

That scenario is most easily reproducible with igt@i915moduleload@reload-with-fault-injection.

Fix the issue by moving the cleanup step to driver release path.

(cherry picked from commit 795dbde92fe5c6996a02a5b579481de73035e7bf)

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

27536e03271da3dafcdddf735102041a26ad5bd0

Fixed

9f5ef4a5eaa61a7a4ed31231da45deb85065397a

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

27536e03271da3dafcdddf735102041a26ad5bd0

Fixed

c5a906806162aea62dbe5d327760ce3b7117ca17

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

27536e03271da3dafcdddf735102041a26ad5bd0

Fixed

4bd4bf79bcfe101f0385ab81dbabb6e3f7d96c00

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

27536e03271da3dafcdddf735102041a26ad5bd0

Fixed

f104ef4db9f8f3923cc06ed1fafb3da38df6006d

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

27536e03271da3dafcdddf735102041a26ad5bd0

Fixed

e3ea2eae70692a455e256787e4f54153fb739b90

Affected versions

v6.*

v6.0

v6.0-rc3

v6.0-rc4

v6.0-rc5

v6.0-rc6

v6.0-rc7

v6.1

v6.1-rc1

v6.1-rc2

v6.1-rc3

v6.1-rc4

v6.1-rc5

v6.1-rc6

v6.1-rc7

v6.1-rc8

v6.10

v6.10-rc1

v6.10-rc2

v6.10-rc3

v6.10-rc4

v6.10-rc5

v6.10-rc6

v6.10-rc7

v6.11

v6.11-rc1

v6.11-rc2

v6.11-rc3

v6.11-rc4

v6.11-rc5

v6.11-rc6

v6.11-rc7

v6.12

v6.12-rc1

v6.12-rc2

v6.12-rc3

v6.12-rc4

v6.12-rc5

v6.12-rc6

v6.12-rc7

v6.12.1

v6.12.10

v6.12.11

v6.12.12

v6.12.13

v6.12.14

v6.12.15

v6.12.16

v6.12.17

v6.12.18

v6.12.19

v6.12.2

v6.12.20

v6.12.21

v6.12.22

v6.12.23

v6.12.3

v6.12.4

v6.12.5

v6.12.6

v6.12.7

v6.12.8

v6.12.9

v6.13

v6.13-rc1

v6.13-rc2

v6.13-rc3

v6.13-rc4

v6.13-rc5

v6.13-rc6

v6.13-rc7

v6.13.1

v6.13.10

v6.13.11

v6.13.2

v6.13.3

v6.13.4

v6.13.5

v6.13.6

v6.13.7

v6.13.8

v6.13.9

v6.14

v6.14-rc1

v6.14-rc2

v6.14-rc3

v6.14-rc4

v6.14-rc5

v6.14-rc6

v6.14-rc7

v6.14.1

v6.14.2

v6.15-rc1

v6.2

v6.2-rc1

v6.2-rc2

v6.2-rc3

v6.2-rc4

v6.2-rc5

v6.2-rc6

v6.2-rc7

v6.2-rc8

v6.3

v6.3-rc1

v6.3-rc2

v6.3-rc3

v6.3-rc4

v6.3-rc5

v6.3-rc6

v6.3-rc7

v6.4

v6.4-rc1

v6.4-rc2

v6.4-rc3

v6.4-rc4

v6.4-rc5

v6.4-rc6

v6.4-rc7

v6.5

v6.5-rc1

v6.5-rc2

v6.5-rc3

v6.5-rc4

v6.5-rc5

v6.5-rc6

v6.5-rc7

v6.6

v6.6-rc1

v6.6-rc2

v6.6-rc3

v6.6-rc4

v6.6-rc5

v6.6-rc6

v6.6-rc7

v6.6.1

v6.6.10

v6.6.11

v6.6.12

v6.6.13

v6.6.14

v6.6.15

v6.6.16

v6.6.17

v6.6.18

v6.6.19

v6.6.2

v6.6.20

v6.6.21

v6.6.22

v6.6.23

v6.6.24

v6.6.25

v6.6.26

v6.6.27

v6.6.28

v6.6.29

v6.6.3

v6.6.30

v6.6.31

v6.6.32

v6.6.33

v6.6.34

v6.6.35

v6.6.36

v6.6.37

v6.6.38

v6.6.39

v6.6.4

v6.6.40

v6.6.41

v6.6.42

v6.6.43

v6.6.44

v6.6.45

v6.6.46

v6.6.47

v6.6.48

v6.6.49

v6.6.5

v6.6.50

v6.6.51

v6.6.52

v6.6.53

v6.6.54

v6.6.55

v6.6.56

v6.6.57

v6.6.58

v6.6.59

v6.6.6

v6.6.60

v6.6.61

v6.6.62

v6.6.63

v6.6.64

v6.6.65

v6.6.66

v6.6.67

v6.6.68

v6.6.69

v6.6.7

v6.6.70

v6.6.71

v6.6.72

v6.6.73

v6.6.74

v6.6.75

v6.6.76

v6.6.77

v6.6.78

v6.6.79

v6.6.8

v6.6.80

v6.6.81

v6.6.82

v6.6.83

v6.6.84

v6.6.85

v6.6.86

v6.6.87

v6.6.9

v6.7

v6.7-rc1

v6.7-rc2

v6.7-rc3

v6.7-rc4

v6.7-rc5

v6.7-rc6

v6.7-rc7

v6.7-rc8

v6.8

v6.8-rc1

v6.8-rc2

v6.8-rc3

v6.8-rc4

v6.8-rc5

v6.8-rc6

v6.8-rc7

v6.9

v6.9-rc1

v6.9-rc2

v6.9-rc3

v6.9-rc4

v6.9-rc5

v6.9-rc6

v6.9-rc7

Database specific

vanir_signatures

[
    {
        "signature_type": "Line",
        "deprecated": false,
        "target": {
            "file": "drivers/gpu/drm/i915/gt/uc/intel_huc.h"
        },
        "digest": {
            "line_hashes": [
                "112560226553082162541329550264143286926",
                "335649741354475012760842639832129863763",
                "117256291334644118081169082531110081804",
                "213981037704213865608996543955644679901"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e3ea2eae70692a455e256787e4f54153fb739b90",
        "signature_version": "v1",
        "id": "CVE-2025-37754-084a374a"
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "target": {
            "file": "drivers/gpu/drm/i915/gt/uc/intel_huc.h"
        },
        "digest": {
            "line_hashes": [
                "112560226553082162541329550264143286926",
                "335649741354475012760842639832129863763",
                "117256291334644118081169082531110081804",
                "223828960169575993706265942387605617231"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4bd4bf79bcfe101f0385ab81dbabb6e3f7d96c00",
        "signature_version": "v1",
        "id": "CVE-2025-37754-10591c3a"
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "target": {
            "file": "drivers/gpu/drm/i915/gt/uc/intel_uc.c"
        },
        "digest": {
            "line_hashes": [
                "285220044771404833076802847183495493920",
                "99379462408249093293752782293826061682",
                "21512725455628333720202960832839912319",
                "298100609562012648822005909386786940696"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9f5ef4a5eaa61a7a4ed31231da45deb85065397a",
        "signature_version": "v1",
        "id": "CVE-2025-37754-143cbf71"
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "target": {
            "file": "drivers/gpu/drm/i915/gt/uc/intel_huc.h"
        },
        "digest": {
            "line_hashes": [
                "112560226553082162541329550264143286926",
                "335649741354475012760842639832129863763",
                "117256291334644118081169082531110081804",
                "223828960169575993706265942387605617231"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c5a906806162aea62dbe5d327760ce3b7117ca17",
        "signature_version": "v1",
        "id": "CVE-2025-37754-1f458d76"
    },
    {
        "signature_type": "Function",
        "deprecated": false,
        "target": {
            "file": "drivers/gpu/drm/i915/gt/uc/intel_huc.c",
            "function": "intel_huc_fini"
        },
        "digest": {
            "length": 184.0,
            "function_hash": "55021748685858421545789941814390550587"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4bd4bf79bcfe101f0385ab81dbabb6e3f7d96c00",
        "signature_version": "v1",
        "id": "CVE-2025-37754-2ab5337c"
    },
    {
        "signature_type": "Function",
        "deprecated": false,
        "target": {
            "file": "drivers/gpu/drm/i915/gt/uc/intel_huc.c",
            "function": "intel_huc_fini"
        },
        "digest": {
            "length": 184.0,
            "function_hash": "55021748685858421545789941814390550587"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c5a906806162aea62dbe5d327760ce3b7117ca17",
        "signature_version": "v1",
        "id": "CVE-2025-37754-6e25dc80"
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "target": {
            "file": "drivers/gpu/drm/i915/gt/uc/intel_huc.c"
        },
        "digest": {
            "line_hashes": [
                "240499613069198268706423081191371359469",
                "63451159111475949922511266795217843551",
                "142185985025953259889484231687253008135",
                "177058364526152182670850719834765237409",
                "327510381247370842996507498320776694944",
                "92341436641014309802063633762068205545",
                "184378331201532090235522406839322229210"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4bd4bf79bcfe101f0385ab81dbabb6e3f7d96c00",
        "signature_version": "v1",
        "id": "CVE-2025-37754-7e97f61e"
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "target": {
            "file": "drivers/gpu/drm/i915/gt/uc/intel_uc.c"
        },
        "digest": {
            "line_hashes": [
                "285220044771404833076802847183495493920",
                "99379462408249093293752782293826061682",
                "21512725455628333720202960832839912319",
                "298100609562012648822005909386786940696"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4bd4bf79bcfe101f0385ab81dbabb6e3f7d96c00",
        "signature_version": "v1",
        "id": "CVE-2025-37754-93000ae7"
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "target": {
            "file": "drivers/gpu/drm/i915/gt/uc/intel_huc.c"
        },
        "digest": {
            "line_hashes": [
                "240499613069198268706423081191371359469",
                "63451159111475949922511266795217843551",
                "142185985025953259889484231687253008135",
                "177058364526152182670850719834765237409",
                "327510381247370842996507498320776694944",
                "92341436641014309802063633762068205545",
                "184378331201532090235522406839322229210"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c5a906806162aea62dbe5d327760ce3b7117ca17",
        "signature_version": "v1",
        "id": "CVE-2025-37754-9b9d0a2e"
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "target": {
            "file": "drivers/gpu/drm/i915/gt/uc/intel_huc.h"
        },
        "digest": {
            "line_hashes": [
                "112560226553082162541329550264143286926",
                "335649741354475012760842639832129863763",
                "117256291334644118081169082531110081804",
                "223828960169575993706265942387605617231"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9f5ef4a5eaa61a7a4ed31231da45deb85065397a",
        "signature_version": "v1",
        "id": "CVE-2025-37754-9d2cd03d"
    },
    {
        "signature_type": "Function",
        "deprecated": false,
        "target": {
            "file": "drivers/gpu/drm/i915/gt/uc/intel_uc.c",
            "function": "intel_uc_driver_late_release"
        },
        "digest": {
            "length": 36.0,
            "function_hash": "37913203616836891220170170450205161346"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c5a906806162aea62dbe5d327760ce3b7117ca17",
        "signature_version": "v1",
        "id": "CVE-2025-37754-a91f5928"
    },
    {
        "signature_type": "Function",
        "deprecated": false,
        "target": {
            "file": "drivers/gpu/drm/i915/gt/uc/intel_uc.c",
            "function": "intel_uc_driver_late_release"
        },
        "digest": {
            "length": 36.0,
            "function_hash": "37913203616836891220170170450205161346"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9f5ef4a5eaa61a7a4ed31231da45deb85065397a",
        "signature_version": "v1",
        "id": "CVE-2025-37754-ae44c233"
    },
    {
        "signature_type": "Function",
        "deprecated": false,
        "target": {
            "file": "drivers/gpu/drm/i915/gt/uc/intel_huc.c",
            "function": "intel_huc_fini"
        },
        "digest": {
            "length": 184.0,
            "function_hash": "55021748685858421545789941814390550587"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e3ea2eae70692a455e256787e4f54153fb739b90",
        "signature_version": "v1",
        "id": "CVE-2025-37754-c7b266b7"
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "target": {
            "file": "drivers/gpu/drm/i915/gt/uc/intel_huc.c"
        },
        "digest": {
            "line_hashes": [
                "240499613069198268706423081191371359469",
                "63451159111475949922511266795217843551",
                "142185985025953259889484231687253008135",
                "177058364526152182670850719834765237409",
                "327510381247370842996507498320776694944",
                "92341436641014309802063633762068205545",
                "184378331201532090235522406839322229210"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9f5ef4a5eaa61a7a4ed31231da45deb85065397a",
        "signature_version": "v1",
        "id": "CVE-2025-37754-cd4bcbe8"
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "target": {
            "file": "drivers/gpu/drm/i915/gt/uc/intel_uc.c"
        },
        "digest": {
            "line_hashes": [
                "285220044771404833076802847183495493920",
                "99379462408249093293752782293826061682",
                "21512725455628333720202960832839912319",
                "298100609562012648822005909386786940696"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c5a906806162aea62dbe5d327760ce3b7117ca17",
        "signature_version": "v1",
        "id": "CVE-2025-37754-ddcfc3db"
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "target": {
            "file": "drivers/gpu/drm/i915/gt/uc/intel_huc.c"
        },
        "digest": {
            "line_hashes": [
                "240499613069198268706423081191371359469",
                "63451159111475949922511266795217843551",
                "142185985025953259889484231687253008135",
                "177058364526152182670850719834765237409",
                "327510381247370842996507498320776694944",
                "92341436641014309802063633762068205545",
                "184378331201532090235522406839322229210"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e3ea2eae70692a455e256787e4f54153fb739b90",
        "signature_version": "v1",
        "id": "CVE-2025-37754-deef585c"
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "target": {
            "file": "drivers/gpu/drm/i915/gt/uc/intel_uc.c"
        },
        "digest": {
            "line_hashes": [
                "285220044771404833076802847183495493920",
                "99379462408249093293752782293826061682",
                "21512725455628333720202960832839912319",
                "298100609562012648822005909386786940696"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e3ea2eae70692a455e256787e4f54153fb739b90",
        "signature_version": "v1",
        "id": "CVE-2025-37754-dfc99cf4"
    },
    {
        "signature_type": "Function",
        "deprecated": false,
        "target": {
            "file": "drivers/gpu/drm/i915/gt/uc/intel_uc.c",
            "function": "intel_uc_driver_late_release"
        },
        "digest": {
            "length": 36.0,
            "function_hash": "37913203616836891220170170450205161346"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4bd4bf79bcfe101f0385ab81dbabb6e3f7d96c00",
        "signature_version": "v1",
        "id": "CVE-2025-37754-e66a5bf0"
    },
    {
        "signature_type": "Function",
        "deprecated": false,
        "target": {
            "file": "drivers/gpu/drm/i915/gt/uc/intel_huc.c",
            "function": "intel_huc_fini"
        },
        "digest": {
            "length": 184.0,
            "function_hash": "55021748685858421545789941814390550587"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9f5ef4a5eaa61a7a4ed31231da45deb85065397a",
        "signature_version": "v1",
        "id": "CVE-2025-37754-f28d632a"
    },
    {
        "signature_type": "Function",
        "deprecated": false,
        "target": {
            "file": "drivers/gpu/drm/i915/gt/uc/intel_uc.c",
            "function": "intel_uc_driver_late_release"
        },
        "digest": {
            "length": 36.0,
            "function_hash": "37913203616836891220170170450205161346"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e3ea2eae70692a455e256787e4f54153fb739b90",
        "signature_version": "v1",
        "id": "CVE-2025-37754-f7dbd877"
    }
]

Linux / Kernel

Package

Name: Kernel

Affected ranges

Type: ECOSYSTEM
Events: Introduced

6.2.0

Fixed

6.6.88

Type: ECOSYSTEM
Events: Introduced

6.7.0

Fixed

6.12.24

Type: ECOSYSTEM
Events: Introduced

6.13.0

Fixed

6.13.12

Type: ECOSYSTEM
Events: Introduced

6.14.0

Fixed

6.14.3