{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2025-68207",
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "state": "PUBLISHED",
        "assignerShortName": "Linux",
        "dateReserved": "2025-12-16T13:41:40.255Z",
        "datePublished": "2025-12-16T13:48:34.574Z",
        "dateUpdated": "2026-08-05T12:10:12.784Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
                "shortName": "Linux",
                "dateUpdated": "2026-08-05T12:10:12.784Z"
            },
            "descriptions": [
                {
                    "lang": "en",
                    "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/guc: Synchronize Dead CT worker with unbind\n\nCancel and wait for any Dead CT worker to complete before continuing\nwith device unbinding. Else the worker will end up using resources freed\nby the undind operation.\n\n(cherry picked from commit 492671339114e376aaa38626d637a2751cdef263)"
                }
            ],
            "metrics": [
                {
                    "cvssV3_1": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                        "baseScore": 7.8,
                        "baseSeverity": "HIGH"
                    },
                    "scenarios": [
                        {
                            "lang": "en",
                            "value": "AV:L - Triggering uses local Xe render-device ioctls and local device-lifetime teardown, not network or adjacent packet processing.\nAC:L - On an affected CONFIG_DRM_XE_DEBUG build, an attacker can flood recoverable GPU faults to queue the worker and retain or release the final render-device reference to align it with teardown. Automated device or VF teardown makes repeated attempts practical.\nPR:L - The required Xe VM, VM_BIND, execution-queue, and execution ioctls are DRM_RENDER_ALLOW and require no capability, DRM-master status, or init-namespace privilege; ordinary render-node access suffices.\nUI:N - No victim must open or process attacker-controlled content, and device or VF teardown can occur automatically as part of its managed lifecycle.\nS:U - The use-after-free compromises resources within the same host-kernel security authority and does not inherently cross a VM, IOMMU, or other security boundary.\nC:H - The worker dereferences released Xe device, GT, and snapshot structures and prints snapshot data; heap reuse can turn its stale pointer traversal into disclosure of arbitrary kernel memory.\nI:H - The worker writes into the freed Dead-CT object and frees nested snapshot pointers obtained from it, providing exploitable arbitrary-free and heap-corruption behavior that can enable control-flow hijacking.\nA:H - Stale dereferences, locking through freed memory, and invalid or attacker-influenced frees can cause a kernel oops, panic, or hang."
                        }
                    ]
                }
            ],
            "affected": [
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "unaffected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "drivers/gpu/drm/xe/xe_guc_ct.c"
                    ],
                    "versions": [
                        {
                            "version": "ff6482fb458953e111a82b7c537363d9aacf04bf",
                            "lessThan": "35959ab7d16b618616edf6df882a4533d2efe193",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "d2c5a5a926f43b2e42c5c955f917bad8ad6dd68c",
                            "lessThan": "ce6ccf8e881a919bf902174ac879f80c97669498",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "d2c5a5a926f43b2e42c5c955f917bad8ad6dd68c",
                            "lessThan": "95af8f4fdce8349a5fe75264007f1af2aa1082ea",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "6.12.37",
                            "lessThan": "6.12.59",
                            "status": "affected",
                            "versionType": "semver"
                        }
                    ]
                },
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "affected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "drivers/gpu/drm/xe/xe_guc_ct.c"
                    ],
                    "versions": [
                        {
                            "version": "6.13",
                            "status": "affected"
                        },
                        {
                            "version": "0",
                            "lessThan": "6.13",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.12.59",
                            "lessThanOrEqual": "6.12.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.17.9",
                            "lessThanOrEqual": "6.17.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.18",
                            "lessThanOrEqual": "*",
                            "status": "unaffected",
                            "versionType": "original_commit_for_fix"
                        }
                    ]
                }
            ],
            "cpeApplicability": [
                {
                    "nodes": [
                        {
                            "operator": "OR",
                            "negate": false,
                            "cpeMatch": [
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.12.37",
                                    "versionEndExcluding": "6.12.59"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.13",
                                    "versionEndExcluding": "6.17.9"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.13",
                                    "versionEndExcluding": "6.18"
                                }
                            ]
                        }
                    ]
                }
            ],
            "references": [
                {
                    "url": "https://git.kernel.org/stable/c/35959ab7d16b618616edf6df882a4533d2efe193"
                },
                {
                    "url": "https://git.kernel.org/stable/c/ce6ccf8e881a919bf902174ac879f80c97669498"
                },
                {
                    "url": "https://git.kernel.org/stable/c/95af8f4fdce8349a5fe75264007f1af2aa1082ea"
                }
            ],
            "title": "drm/xe/guc: Synchronize Dead CT worker with unbind",
            "x_generator": {
                "engine": "bippy-1.2.0"
            }
        }
    }
}