CVE-2026-68382
Estado: RecibidaAlta (7.8)—
In the Linux kernel, the following vulnerability has been resolved:
drm/xe/guc: Hold device ref until queue teardown completes
GuC exec queue destruction can run asynchronously. If the final device put happens from a destroy worker, drmm cleanup can end up draining the same workqueue and deadlock.
Hold a drm_device reference for the queue lifetime and drop it after queue teardown completes. This keeps drmm cleanup from running while async destroy work is still pending.
Move GuC destroy work to a module-lifetime Xe workqueue and flush it on PCI remove so hot-unbind/rebind still waits for pending destroy work.
Leer descripción completaMostrar menos
With queue-held device refs, guc_submit_sw_fini() cannot run with live GuC IDs. Replace the fini wait with an assertion and remove the unused fini_wq.
(cherry picked from commit da1124abac689cc2b1d8995e5f0a816f8a122edb)
Detalles técnicos trazas, registros y código del informe original
v2:
- Rebase
v3:
- Switch to queue-lifetime drm_dev_get()/drm_dev_put() model. (Matt)
- Queue async teardown on system_dfl_wq instead of xe->destroy_wq. (Matt)
- Drop separate deferred drm_dev_put worker.
- Remove stale drain_workqueue(xe->destroy_wq) from guc_submit_sw_fini().
v4:
- Replace the guc_submit_sw_fini() wait with an assertion and remove
the now-unused fini_wq. (sashiko)
v5:
- Move destroy work to a module-lifetime Xe workqueue instead of
system_dfl_wq. (Matt)
- Flush the module-lifetime destroy workqueue during PCI remove to
preserve the old device-remove wait semantics.
v6:
- Keep SVM pagemap destroy work on the per-device destroy_wq to avoid
letting it outlive the xe_device/drm_device. (Sashiko)
- Use WQ_MEM_RECLAIM for xe->destroy_wq because SVM pagemap destroy work
can be queued from the reclaim path.
v7:
- Drop the per-device xe->destroy_wq and use the module-level destroy WQ
for SVM pagemap destroy as well. (Matt)
- Rename xe_exec_queue_destroy_wq_*() helpers to xe_destroy_wq_*()
helpers because the WQ is no longer exec-queue specific. (Matt)
v8:
- Rebase.
v9:
- Keep SVM pagemap destroy work on the per-device WQ_MEM_RECLAIM
destroy_wq because it can be queued from reclaim and embeds
the dev_pagemap used by devres teardown. (Sashiko)
- Keep the module-level destroy WQ GuC-only and drop WQ_MEM_RECLAIM
from it.
- Update the module-WQ kdoc to document the GuC/SVM split.
v10:
- Keep xe->destroy_wq per-cpu while adding WQ_MEM_RECLAIM to fix the
workqueue allocation warning.
v11:
- Drop the SVM pagemap destroy comment as it was revision-specific.
(Thomas)
v12:
- Rebase.CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Puntuación base: 7.8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.17%
- Percentil entre todas las CVEs puntuadas: 5
- Fecha de la puntuación: 5/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
🎯 Técnicas ATT&CK
Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.
- Explotación
T1068Exploitation for Privilege Escalationprivilege escalation45 % - Impacto principal
T1499.004Application or System Exploitationimpact35 %
AV:L/PR:L indica escalada local; la vulnerabilidad es un deadlock en la limpieza de recursos del kernel (drm/xe/guc), no es explotable remotamente para ejecutar código sino para causar DoS por negación de servicio del sistema.
Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.
🛡️ Mitigaciones ATT&CK que cubren estas técnicas
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-68382",
"cveTags": [],
"metrics": {
"cvssMetricV31": [
{
"type": "Secondary",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.8,
"attackVector": "LOCAL",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 1.8
}
]
},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "2d2be279f1ca9e7288282d4214f16eea8a727cdb",
"lessThan": "03d6f83979b0d75a0b0893dfe1735ec93facf515",
"versionType": "git"
},
{
"status": "affected",
"version": "2d2be279f1ca9e7288282d4214f16eea8a727cdb",
"lessThan": "9b7e60184f4b22e893d4ae95234d5f26261a430c",
"versionType": "git"
},
{
"status": "affected",
"version": "272b0e78874586d6ccae04079d75b27b47705544",
"versionType": "git"
},
{
"status": "affected",
"version": "421c74670b0f9d5c007f1276d3647aa58f407fde",
"versionType": "git"
},
{
"status": "affected",
"version": "6.10.14",
"lessThan": "6.11",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.11.3",
"lessThan": "6.12",
"versionType": "semver"
}
],
"programFiles": [
"drivers/gpu/drm/xe/xe_device.c",
"drivers/gpu/drm/xe/xe_device_types.h",
"drivers/gpu/drm/xe/xe_guc_submit.c",
"drivers/gpu/drm/xe/xe_guc_types.h",
"drivers/gpu/drm/xe/xe_module.c",
"drivers/gpu/drm/xe/xe_module.h",
"drivers/gpu/drm/xe/xe_pci.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.12",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver",
"lessThanOrEqual": "7.1.*"
},
{
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/gpu/drm/xe/xe_device.c",
"drivers/gpu/drm/xe/xe_device_types.h",
"drivers/gpu/drm/xe/xe_guc_submit.c",
"drivers/gpu/drm/xe/xe_guc_types.h",
"drivers/gpu/drm/xe/xe_module.c",
"drivers/gpu/drm/xe/xe_module.h",
"drivers/gpu/drm/xe/xe_pci.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-08-10T13:20:31.343",
"references": [
{
"url": "https://git.kernel.org/stable/c/03d6f83979b0d75a0b0893dfe1735ec93facf515",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9b7e60184f4b22e893d4ae95234d5f26261a430c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/guc: Hold device ref until queue teardown completes\n\nGuC exec queue destruction can run asynchronously. If the final device\nput happens from a destroy worker, drmm cleanup can end up draining\nthe same workqueue and deadlock.\n\nHold a drm_device reference for the queue lifetime and drop it after\nqueue teardown completes. This keeps drmm cleanup from running while\nasync destroy work is still pending.\n\nMove GuC destroy work to a module-lifetime Xe workqueue and flush it\non PCI remove so hot-unbind/rebind still waits for pending destroy work.\n\nWith queue-held device refs, guc_submit_sw_fini() cannot run with live\nGuC IDs. Replace the fini wait with an assertion and remove the unused\nfini_wq.\n\nv2:\n - Rebase\n\nv3:\n - Switch to queue-lifetime drm_dev_get()/drm_dev_put() model. (Matt)\n - Queue async teardown on system_dfl_wq instead of xe->destroy_wq. (Matt)\n - Drop separate deferred drm_dev_put worker.\n - Remove stale drain_workqueue(xe->destroy_wq) from guc_submit_sw_fini().\n\nv4:\n - Replace the guc_submit_sw_fini() wait with an assertion and remove\n the now-unused fini_wq. (sashiko)\n\nv5:\n - Move destroy work to a module-lifetime Xe workqueue instead of\n system_dfl_wq. (Matt)\n - Flush the module-lifetime destroy workqueue during PCI remove to\n preserve the old device-remove wait semantics.\n\nv6:\n - Keep SVM pagemap destroy work on the per-device destroy_wq to avoid\n letting it outlive the xe_device/drm_device. (Sashiko)\n - Use WQ_MEM_RECLAIM for xe->destroy_wq because SVM pagemap destroy work\n can be queued from the reclaim path.\n\nv7:\n - Drop the per-device xe->destroy_wq and use the module-level destroy WQ\n for SVM pagemap destroy as well. (Matt)\n - Rename xe_exec_queue_destroy_wq_*() helpers to xe_destroy_wq_*()\n helpers because the WQ is no longer exec-queue specific. (Matt)\n\nv8:\n - Rebase.\n\nv9:\n - Keep SVM pagemap destroy work on the per-device WQ_MEM_RECLAIM\n destroy_wq because it can be queued from reclaim and embeds\n the dev_pagemap used by devres teardown. (Sashiko)\n - Keep the module-level destroy WQ GuC-only and drop WQ_MEM_RECLAIM\n from it.\n - Update the module-WQ kdoc to document the GuC/SVM split.\n\nv10:\n - Keep xe->destroy_wq per-cpu while adding WQ_MEM_RECLAIM to fix the\n workqueue allocation warning.\n\nv11:\n - Drop the SVM pagemap destroy comment as it was revision-specific.\n (Thomas)\n\nv12:\n - Rebase.\n\n(cherry picked from commit da1124abac689cc2b1d8995e5f0a816f8a122edb)"
}
],
"lastModified": "2026-08-17T06:17:46.683",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}