CVE-2025-68207

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-68207", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-12-16T13:41:40.255Z", "datePublished": "2025-12-16T13:48:34.574Z", "dateUpdated": "2026-10-15T22:02:47.710Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:10:12.784Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/guc: Synchronize Dead CT worker with unbind\n\nCancel and wait for any Dead CT worker to complete before continuing\nwith device unbinding. Else the worker will end up using resources freed\nby the undind operation.\n\n(cherry picked from commit 492671339114e376aaa38626d637a2751cdef263)"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - Triggering uses local Xe render-device ioctls and local device-lifetime teardown, not network or adjacent packet processing.\nAC:L - On an affected CONFIG_DRM_XE_DEBUG build, an attacker can flood recoverable GPU faults to queue the worker and retain or release the final render-device reference to align it with teardown. Automated device or VF teardown makes repeated attempts practical.\nPR:L - The required Xe VM, VM_BIND, execution-queue, and execution ioctls are DRM_RENDER_ALLOW and require no capability, DRM-master status, or init-namespace privilege; ordinary render-node access suffices.\nUI:N - No victim must open or process attacker-controlled content, and device or VF teardown can occur automatically as part of its managed lifecycle.\nS:U - The use-after-free compromises resources within the same host-kernel security authority and does not inherently cross a VM, IOMMU, or other security boundary.\nC:H - The worker dereferences released Xe device, GT, and snapshot structures and prints snapshot data; heap reuse can turn its stale pointer traversal into disclosure of arbitrary kernel memory.\nI:H - The worker writes into the freed Dead-CT object and frees nested snapshot pointers obtained from it, providing exploitable arbitrary-free and heap-corruption behavior that can enable control-flow hijacking.\nA:H - Stale dereferences, locking through freed memory, and invalid or attacker-influenced frees can cause a kernel oops, panic, or hang."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/xe/xe_guc_ct.c"], "versions": [{"version": "ff6482fb458953e111a82b7c537363d9aacf04bf", "lessThan": "35959ab7d16b618616edf6df882a4533d2efe193", "status": "affected", "versionType": "git"}, {"version": "d2c5a5a926f43b2e42c5c955f917bad8ad6dd68c", "lessThan": "ce6ccf8e881a919bf902174ac879f80c97669498", "status": "affected", "versionType": "git"}, {"version": "d2c5a5a926f43b2e42c5c955f917bad8ad6dd68c", "lessThan": "95af8f4fdce8349a5fe75264007f1af2aa1082ea", "status": "affected", "versionType": "git"}, {"version": "6.12.37", "lessThan": "6.12.59", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/xe/xe_guc_ct.c"], "versions": [{"version": "6.13", "status": "affected"}, {"version": "0", "lessThan": "6.13", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.59", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.17.9", "lessThanOrEqual": "6.17.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.37", "versionEndExcluding": "6.12.59"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.17.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.18"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/35959ab7d16b618616edf6df882a4533d2efe193"}, {"url": "https://git.kernel.org/stable/c/ce6ccf8e881a919bf902174ac879f80c97669498"}, {"url": "https://git.kernel.org/stable/c/95af8f4fdce8349a5fe75264007f1af2aa1082ea"}], "title": "drm/xe/guc: Synchronize Dead CT worker with unbind", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-68207", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T22:00:11.478144Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T22:02:47.710Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-68207", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T22:00:11.478144Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T22:00:12.076Z"}}], "cna": {"title": "drm/xe/guc: Synchronize Dead CT worker with unbind", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - Triggering uses local Xe render-device ioctls and local device-lifetime teardown, not network or adjacent packet processing.\nAC:L - On an affected CONFIG_DRM_XE_DEBUG build, an attacker can flood recoverable GPU faults to queue the worker and retain or release the final render-device reference to align it with teardown. Automated device or VF teardown makes repeated attempts practical.\nPR:L - The required Xe VM, VM_BIND, execution-queue, and execution ioctls are DRM_RENDER_ALLOW and require no capability, DRM-master status, or init-namespace privilege; ordinary render-node access suffices.\nUI:N - No victim must open or process attacker-controlled content, and device or VF teardown can occur automatically as part of its managed lifecycle.\nS:U - The use-after-free compromises resources within the same host-kernel security authority and does not inherently cross a VM, IOMMU, or other security boundary.\nC:H - The worker dereferences released Xe device, GT, and snapshot structures and prints snapshot data; heap reuse can turn its stale pointer traversal into disclosure of arbitrary kernel memory.\nI:H - The worker writes into the freed Dead-CT object and frees nested snapshot pointers obtained from it, providing exploitable arbitrary-free and heap-corruption behavior that can enable control-flow hijacking.\nA:H - Stale dereferences, locking through freed memory, and invalid or attacker-influenced frees can cause a kernel oops, panic, or hang."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "ff6482fb458953e111a82b7c537363d9aacf04bf", "lessThan": "35959ab7d16b618616edf6df882a4533d2efe193", "versionType": "git"}, {"status": "affected", "version": "d2c5a5a926f43b2e42c5c955f917bad8ad6dd68c", "lessThan": "ce6ccf8e881a919bf902174ac879f80c97669498", "versionType": "git"}, {"status": "affected", "version": "d2c5a5a926f43b2e42c5c955f917bad8ad6dd68c", "lessThan": "95af8f4fdce8349a5fe75264007f1af2aa1082ea", "versionType": "git"}, {"status": "affected", "version": "6.12.37", "lessThan": "6.12.59", "versionType": "semver"}], "programFiles": ["drivers/gpu/drm/xe/xe_guc_ct.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.13"}, {"status": "unaffected", "version": "0", "lessThan": "6.13", "versionType": "semver"}, {"status": "unaffected", "version": "6.12.59", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.17.9", "versionType": "semver", "lessThanOrEqual": "6.17.*"}, {"status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/gpu/drm/xe/xe_guc_ct.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/35959ab7d16b618616edf6df882a4533d2efe193"}, {"url": "https://git.kernel.org/stable/c/ce6ccf8e881a919bf902174ac879f80c97669498"}, {"url": "https://git.kernel.org/stable/c/95af8f4fdce8349a5fe75264007f1af2aa1082ea"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/guc: Synchronize Dead CT worker with unbind\n\nCancel and wait for any Dead CT worker to complete before continuing\nwith device unbinding. Else the worker will end up using resources freed\nby the undind operation.\n\n(cherry picked from commit 492671339114e376aaa38626d637a2751cdef263)"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.59", "versionStartIncluding": "6.12.37"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.17.9", "versionStartIncluding": "6.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18", "versionStartIncluding": "6.13"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:10:12.784Z"}}}, "cveMetadata": {"cveId": "CVE-2025-68207", "state": "PUBLISHED", "dateUpdated": "2026-10-15T22:02:47.710Z", "dateReserved": "2025-12-16T13:41:40.255Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-12-16T13:48:34.574Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/xe/xe_guc_ct.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "35959ab7d16b618616edf6df882a4533d2efe193", "status": "affected", "version": "ff6482fb458953e111a82b7c537363d9aacf04bf", "versionType": "git"}, {"lessThan": "ce6ccf8e881a919bf902174ac879f80c97669498", "status": "affected", "version": "d2c5a5a926f43b2e42c5c955f917bad8ad6dd68c", "versionType": "git"}, {"lessThan": "95af8f4fdce8349a5fe75264007f1af2aa1082ea", "status": "affected", "version": "d2c5a5a926f43b2e42c5c955f917bad8ad6dd68c", "versionType": "git"}, {"lessThan": "6.12.59", "status": "affected", "version": "6.12.37", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/xe/xe_guc_ct.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.13"}, {"lessThan": "6.13", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.59", "versionType": "semver"}, {"lessThanOrEqual": "6.17.*", "status": "unaffected", "version": "6.17.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/guc: Synchronize Dead CT worker with unbind\n\nCancel and wait for any Dead CT worker to complete before continuing\nwith device unbinding. Else the worker will end up using resources freed\nby the undind operation.\n\n(cherry picked from commit 492671339114e376aaa38626d637a2751cdef263)"}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndrm/xe/guc: Sincronizar el trabajador Dead CT con la desvinculaci\u00f3n\n\nCancelar y esperar a que cualquier trabajador Dead CT complete antes de continuar con la desvinculaci\u00f3n del dispositivo. De lo contrario, el trabajador terminar\u00e1 usando recursos liberados por la operaci\u00f3n de desvinculaci\u00f3n.\n\n(seleccionado del commit 492671339114e376aaa38626d637a2751cdef263)"}], "id": "CVE-2025-68207", "lastModified": "2026-10-15T22:19:10.487", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-68207", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T22:00:11.478144Z", "version": "2.0.3"}}]}, "published": "2025-12-16T14:15:53.590", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/35959ab7d16b618616edf6df882a4533d2efe193"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/95af8f4fdce8349a5fe75264007f1af2aa1082ea"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ce6ccf8e881a919bf902174ac879f80c97669498"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Deferred"}

{"bugzilla": {"description": "kernel: drm/xe/guc: Synchronize Dead CT worker with unbind", "id": "2422669", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2422669"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2025-68207", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-12-16T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-68207\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-68207\nhttps://lore.kernel.org/linux-cve-announce/2025121632-CVE-2025-68207-c0f2@gregkh/T"], "threat_severity": "Low"}

{}