CVE-2025-68193

Vulnerability

A use-after-free vulnerability exists in the Linux kernel's drm/xe driver, specifically in the GuC (Graphics micro-Controller) communication transport (CTB) mechanism. When a buffer object (BO) allocated with the XE_BO_FLAG_GGTT_INVALIDATE flag is released, the driver initiates TLB invalidation requests via the CTB mechanism. If the CTB buffer object itself is freed before the TLB invalidation completes, a race condition allows access to freed memory, leading to a system crash [1].

Exploitation

The attack surface is accessible to a local user with sufficient privileges to trigger buffer object allocation and deallocation with the GGTT_INVALIDATE flag in the XE driver. The vulnerability does not require any special network access but does require the ability to interact with the DRM subsystem. The root cause is the lack of proper ordering: the CTB buffer object could be released while TLB invalidation requests were still in-flight, causing a use-after-free in functions like h2g_write and guc_ct_send_locked [1].

Impact

An attacker who successfully triggers the race condition could cause a denial of service (system crash, kernel panic) due to memory corruption. The call trace shows the crash occurs in the xe kernel module during GGTT page table manipulation [1]. No privilege escalation is described, but the crash can render the system unusable.

Mitigation

The fix, introduced in commit ee4b32220a6b (Linux kernel stable branch), adds a devm-managed release action during xe_guc_ct_init() and xe_guc_ct_init_post_hwconfig() to ensure the CTB is safely disabled before the buffer object is deallocated, preventing the use-after-free scenario. Users are advised to apply the latest stable kernel updates containing this patch [1].