CVE-2025-68207

In the Linux kernel, the following vulnerability has been resolved:

drm/xe/guc: Synchronize Dead CT worker with unbind

Cancel and wait for any Dead CT worker to complete before continuing with device unbinding. Else the worker will end up using resources freed by the undind operation.

(cherry picked from commit 492671339114e376aaa38626d637a2751cdef263)

A low-severity race condition was found in the Linux kernel Xe graphics driver's GuC command transport (CT) handling (drivers/gpu/drm/xe/xe_guc_ct.c), affecting Red Hat Enterprise Linux 9.7.z, 9.8, 10.1.z, and 10.2 (kernel and kernel-rt) and Red Hat In-Vehicle OS 1.1. When a GuC CT buffer dies, a "Dead CT" worker is scheduled to handle it; if the device is unbound while that worker is still pending, the worker continues to use resources that the unbind operation has already freed, resulting in a use-after-free. A local user able to trigger this race could crash or destabilize the kernel, causing a denial of service. Red Hat assessed the impact as availability only (CVSS 3.1 score 5.5, Moderate), which is lower than the 7.8 (High) score in the upstream CVE record, because the available evidence does not establish confidentiality or integrity impact.

The vulnerable code entered RHEL through the merge of upstream DRM changes from v6.12 to v6.13; Red Hat Enterprise Linux 6, 7, and 8, the RHEL 9.0 through 9.6.z update streams, and RHEL 10.0 are not affected because the vulnerable code is not present in those releases. For the affected streams, the fix is currently deferred. The residual risk while the fix is deferred is limited: triggering the flaw requires local access and a race between GuC dead-CT handling and device unbind, and the consequence is a local denial of service rather than loss of confidentiality or integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.