CVE-2025-40166

Vulnerability

Overview

In the Linux kernel's drm subsystem for Xe GPUs, a vulnerability exists in the GuC (Graphics micro-controller) exec queue deregistration path. Normally, an exec queue is disabled and deregistered through the GuC, and freed only after the GuC confirms completion. However, if the driver is forced to unbind while the exec queue is still running, the user may call exec_destroy() after the GuC has already been stopped and CT communication disabled. In this case, the driver cannot receive a response from the GuC, preventing proper cleanup of exec queue resources and leading to resource leaks and warning messages [1].

Exploitation

Conditions

The vulnerability is triggered during an unexpected driver unbind while an exec queue is still active. An attacker with local access and the ability to force a driver unbind (e.g., by removing the PCI device) could cause this condition. No special privileges are required beyond the ability to manage GPU workloads and trigger a driver removal. The issue manifests with error logs showing "GUC ID manager unclean" and warnings in the TTM VRAM manager [1].

Impact

An attacker exploiting this vulnerability can cause a denial of service (DoS) by triggering resource leaks and kernel warnings. The leaked exec queue resources may exhaust the GuC ID space, preventing further GPU submissions. Additionally, the kernel warning indicates potential memory management inconsistencies that could lead to system instability or crashes [1].

Mitigation

The fix, included in Linux kernel stable updates, modifies the deregistration path to check the GuC running state using xe_uc_fw_is_running() instead of xe_guc_ct_enabled(). If the GuC is not running, resources are released directly without waiting for a GuC response [1]. Users should update their kernel to a version containing this commit to mitigate the vulnerability.