CVE-2025-68193
- Source
- https://cve.org/CVERecord?id=CVE-2025-68193
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-68193.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2025-68193
- Downstream
- Published
- 2025-12-16T13:43:19.702Z
- Modified
- 2026-01-02T22:07:03.155842Z
- Summary
- drm/xe/guc: Add devm release action to safely tear down CT
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
drm/xe/guc: Add devm release action to safely tear down CT
When a buffer object (BO) is allocated with the XEBOFLAGGGTTINVALIDATE flag, the driver initiates TLB invalidation requests via the CTB mechanism while releasing the BO. However a premature release of the CTB BO can lead to system crashes, as observed in:
Oops: Oops: 0000 [#1] SMP NOPTI RIP: 0010:h2gwrite+0x2f3/0x7c0 [xe] Call Trace: gucctsendlocked+0x8b/0x670 [xe] xegucctsendlocked+0x19/0x60 [xe] sendtlbinvalidation+0xb4/0x460 [xe] xegttlbinvalidationggtt+0x15e/0x2e0 [xe] ggttinvalidategttlb.part.0+0x16/0x90 [xe] ggttnoderemove+0x110/0x140 [xe] xeggttnoderemove+0x40/0xa0 [xe] xeggttremove_bo+0x87/0x250 [xe]
Introduce a devm-managed release action during xegucctinit() and xegucctinitposthwconfig() to ensure proper CTB disablement before resource deallocation, preventing the use-after-free scenario.
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68193.json" }- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/52faa05fcd9f78af99abebe30a4b7b444744c991
- https://git.kernel.org/stable/c/ee4b32220a6b41e71512e8804585325e685456ba
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68193.json
- https://nvd.nist.gov/vuln/detail/CVE-2025-68193
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced231c4110873a5db4975512c30aa10edcc5be56e2Fixed52faa05fcd9f78af99abebe30a4b7b444744c991Fixedee4b32220a6b41e71512e8804585325e685456ba