{"api_version":"1","generated_at":"2026-08-14T21:47:44+00:00","cve":"CVE-2026-68382","urls":{"html":"https://cve.report/CVE-2026-68382","api":"https://cve.report/api/cve/CVE-2026-68382.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-68382","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-68382"},"summary":{"title":"drm/xe/guc: Hold device ref until queue teardown completes","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/guc: Hold device ref until queue teardown completes\n\nGuC exec queue destruction can run asynchronously. If the final device\nput happens from a destroy worker, drmm cleanup can end up draining\nthe same workqueue and deadlock.\n\nHold a drm_device reference for the queue lifetime and drop it after\nqueue teardown completes. This keeps drmm cleanup from running while\nasync destroy work is still pending.\n\nMove GuC destroy work to a module-lifetime Xe workqueue and flush it\non PCI remove so hot-unbind/rebind still waits for pending destroy work.\n\nWith queue-held device refs, guc_submit_sw_fini() cannot run with live\nGuC IDs. Replace the fini wait with an assertion and remove the unused\nfini_wq.\n\nv2:\n  - Rebase\n\nv3:\n  - Switch to queue-lifetime drm_dev_get()/drm_dev_put() model. (Matt)\n  - Queue async teardown on system_dfl_wq instead of xe->destroy_wq. (Matt)\n  - Drop separate deferred drm_dev_put worker.\n  - Remove stale drain_workqueue(xe->destroy_wq) from guc_submit_sw_fini().\n\nv4:\n  - Replace the guc_submit_sw_fini() wait with an assertion and remove\n    the now-unused fini_wq. (sashiko)\n\nv5:\n  - Move destroy work to a module-lifetime Xe workqueue instead of\n    system_dfl_wq. (Matt)\n  - Flush the module-lifetime destroy workqueue during PCI remove to\n    preserve the old device-remove wait semantics.\n\nv6:\n  - Keep SVM pagemap destroy work on the per-device destroy_wq to avoid\n    letting it outlive the xe_device/drm_device. (Sashiko)\n  - Use WQ_MEM_RECLAIM for xe->destroy_wq because SVM pagemap destroy work\n    can be queued from the reclaim path.\n\nv7:\n  - Drop the per-device xe->destroy_wq and use the module-level destroy WQ\n    for SVM pagemap destroy as well. (Matt)\n  - Rename xe_exec_queue_destroy_wq_*() helpers to xe_destroy_wq_*()\n    helpers because the WQ is no longer exec-queue specific. (Matt)\n\nv8:\n  - Rebase.\n\nv9:\n  - Keep SVM pagemap destroy work on the per-device WQ_MEM_RECLAIM\n    destroy_wq because it can be queued from reclaim and embeds\n    the dev_pagemap used by devres teardown. (Sashiko)\n  - Keep the module-level destroy WQ GuC-only and drop WQ_MEM_RECLAIM\n    from it.\n  - Update the module-WQ kdoc to document the GuC/SVM split.\n\nv10:\n  - Keep xe->destroy_wq per-cpu while adding WQ_MEM_RECLAIM to fix the\n    workqueue allocation warning.\n\nv11:\n  - Drop the SVM pagemap destroy comment as it was revision-specific.\n    (Thomas)\n\nv12:\n  - Rebase.\n\n(cherry picked from commit da1124abac689cc2b1d8995e5f0a816f8a122edb)","state":"PUBLISHED","assigner":"Linux","published_at":"2026-08-10 13:20:31","updated_at":"2026-08-13 23:17:33"},"problem_types":[],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/03d6f83979b0d75a0b0893dfe1735ec93facf515","name":"https://git.kernel.org/stable/c/03d6f83979b0d75a0b0893dfe1735ec93facf515","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/9b7e60184f4b22e893d4ae95234d5f26261a430c","name":"https://git.kernel.org/stable/c/9b7e60184f4b22e893d4ae95234d5f26261a430c","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-68382","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68382","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 2d2be279f1ca9e7288282d4214f16eea8a727cdb 03d6f83979b0d75a0b0893dfe1735ec93facf515 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 2d2be279f1ca9e7288282d4214f16eea8a727cdb 9b7e60184f4b22e893d4ae95234d5f26261a430c git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 272b0e78874586d6ccae04079d75b27b47705544 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 421c74670b0f9d5c007f1276d3647aa58f407fde git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.10.14 6.11 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.11.3 6.12 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.12","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1.6 7.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2-rc4 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"68382","cve":"CVE-2026-68382","epss":"0.001620000","percentile":"0.058870000","score_date":"2026-08-13","updated_at":"2026-08-14 00:07:35"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/xe/xe_device.c","drivers/gpu/drm/xe/xe_device_types.h","drivers/gpu/drm/xe/xe_guc_submit.c","drivers/gpu/drm/xe/xe_guc_types.h","drivers/gpu/drm/xe/xe_module.c","drivers/gpu/drm/xe/xe_module.h","drivers/gpu/drm/xe/xe_pci.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"03d6f83979b0d75a0b0893dfe1735ec93facf515","status":"affected","version":"2d2be279f1ca9e7288282d4214f16eea8a727cdb","versionType":"git"},{"lessThan":"9b7e60184f4b22e893d4ae95234d5f26261a430c","status":"affected","version":"2d2be279f1ca9e7288282d4214f16eea8a727cdb","versionType":"git"},{"status":"affected","version":"272b0e78874586d6ccae04079d75b27b47705544","versionType":"git"},{"status":"affected","version":"421c74670b0f9d5c007f1276d3647aa58f407fde","versionType":"git"},{"lessThan":"6.11","status":"affected","version":"6.10.14","versionType":"semver"},{"lessThan":"6.12","status":"affected","version":"6.11.3","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpu/drm/xe/xe_device.c","drivers/gpu/drm/xe/xe_device_types.h","drivers/gpu/drm/xe/xe_guc_submit.c","drivers/gpu/drm/xe/xe_guc_types.h","drivers/gpu/drm/xe/xe_module.c","drivers/gpu/drm/xe/xe_module.h","drivers/gpu/drm/xe/xe_pci.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.12"},{"lessThan":"6.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2-rc4","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1.6","versionStartIncluding":"6.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2-rc4","versionStartIncluding":"6.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.10.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.11.3","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/guc: Hold device ref until queue teardown completes\n\nGuC exec queue destruction can run asynchronously. If the final device\nput happens from a destroy worker, drmm cleanup can end up draining\nthe same workqueue and deadlock.\n\nHold a drm_device reference for the queue lifetime and drop it after\nqueue teardown completes. This keeps drmm cleanup from running while\nasync destroy work is still pending.\n\nMove GuC destroy work to a module-lifetime Xe workqueue and flush it\non PCI remove so hot-unbind/rebind still waits for pending destroy work.\n\nWith queue-held device refs, guc_submit_sw_fini() cannot run with live\nGuC IDs. Replace the fini wait with an assertion and remove the unused\nfini_wq.\n\nv2:\n  - Rebase\n\nv3:\n  - Switch to queue-lifetime drm_dev_get()/drm_dev_put() model. (Matt)\n  - Queue async teardown on system_dfl_wq instead of xe->destroy_wq. (Matt)\n  - Drop separate deferred drm_dev_put worker.\n  - Remove stale drain_workqueue(xe->destroy_wq) from guc_submit_sw_fini().\n\nv4:\n  - Replace the guc_submit_sw_fini() wait with an assertion and remove\n    the now-unused fini_wq. (sashiko)\n\nv5:\n  - Move destroy work to a module-lifetime Xe workqueue instead of\n    system_dfl_wq. (Matt)\n  - Flush the module-lifetime destroy workqueue during PCI remove to\n    preserve the old device-remove wait semantics.\n\nv6:\n  - Keep SVM pagemap destroy work on the per-device destroy_wq to avoid\n    letting it outlive the xe_device/drm_device. (Sashiko)\n  - Use WQ_MEM_RECLAIM for xe->destroy_wq because SVM pagemap destroy work\n    can be queued from the reclaim path.\n\nv7:\n  - Drop the per-device xe->destroy_wq and use the module-level destroy WQ\n    for SVM pagemap destroy as well. (Matt)\n  - Rename xe_exec_queue_destroy_wq_*() helpers to xe_destroy_wq_*()\n    helpers because the WQ is no longer exec-queue specific. (Matt)\n\nv8:\n  - Rebase.\n\nv9:\n  - Keep SVM pagemap destroy work on the per-device WQ_MEM_RECLAIM\n    destroy_wq because it can be queued from reclaim and embeds\n    the dev_pagemap used by devres teardown. (Sashiko)\n  - Keep the module-level destroy WQ GuC-only and drop WQ_MEM_RECLAIM\n    from it.\n  - Update the module-WQ kdoc to document the GuC/SVM split.\n\nv10:\n  - Keep xe->destroy_wq per-cpu while adding WQ_MEM_RECLAIM to fix the\n    workqueue allocation warning.\n\nv11:\n  - Drop the SVM pagemap destroy comment as it was revision-specific.\n    (Thomas)\n\nv12:\n  - Rebase.\n\n(cherry picked from commit da1124abac689cc2b1d8995e5f0a816f8a122edb)"}],"metrics":[{"cvssV3_1":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable state is created through the Intel Xe DRM render node (/dev/dri/renderD*) via DRM_RENDER_ALLOW exec-queue create/destroy ioctls and manifests during local device teardown; no network or adjacent-network input is involved.\nAC:L - The attacker deterministically controls the decisive side of the race: GuC queue teardown blocks on a GuC deregister round-trip and cancel_delayed_work_sync() of the TDR, so long-running contexts with large preempt/job timeouts reliably keep exec_queue_lookup non-empty past guc_submit_sw_fini()'s fixed 5s wait, and the attempt can be repeated freely.\nPR:L - Exec queue creation and destruction are DRM_RENDER_ALLOW ioctls reachable by any unprivileged user holding an open render node, which is granted to logged-in users by default udev/ACL rules on systems with Intel GPUs; no capability or root privilege is needed to leave destroy work pending.\nUI:N - The attacker acts entirely on its own through render-node ioctls and GPU submission; no victim must open a file, mount a filesystem, or take any other action for the stale teardown state to be created.\nS:U - The corruption is confined to kernel memory managed by the same security authority as the xe driver; there is no VM escape, IOMMU/DMA boundary bypass, or other crossing into a different security scope.\nC:H - After the 5s wait times out (the assert is a no-op on production builds), drm_dev_release() kfree()s the whole xe_device while destroy work is pending, so the worker dereferences a freed slab object; the attacker can spray the reclaimed allocation and read back kernel data through the stale xe/guc pointers and xarray.\nI:H - The pending worker writes through the freed xe_device — xa_erase() on the destroyed lookup, mutex operations on submission_state.lock, and xe_guc_id_mgr_release_locked() bitmap updates — giving controlled writes into a reclaimed heap object and a path to control-flow hijack.\nA:H - Use-after-free on the freed device structure reliably oopses or panics the kernel; additionally the drain_workqueue() from a work item on the same destroy workqueue self-deadlocks, hanging device removal indefinitely."}]}],"providerMetadata":{"dateUpdated":"2026-08-13T22:44:05.223Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/03d6f83979b0d75a0b0893dfe1735ec93facf515"},{"url":"https://git.kernel.org/stable/c/9b7e60184f4b22e893d4ae95234d5f26261a430c"}],"title":"drm/xe/guc: Hold device ref until queue teardown completes","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-68382","datePublished":"2026-08-10T12:04:01.187Z","dateReserved":"2026-07-30T09:28:09.387Z","dateUpdated":"2026-08-13T22:44:05.223Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-10 13:20:31","lastModifiedDate":"2026-08-13 23:17:33","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"68382","Ordinal":"1","Title":"drm/xe/guc: Hold device ref until queue teardown completes","CVE":"CVE-2026-68382","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"68382","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/guc: Hold device ref until queue teardown completes\n\nGuC exec queue destruction can run asynchronously. If the final device\nput happens from a destroy worker, drmm cleanup can end up draining\nthe same workqueue and deadlock.\n\nHold a drm_device reference for the queue lifetime and drop it after\nqueue teardown completes. This keeps drmm cleanup from running while\nasync destroy work is still pending.\n\nMove GuC destroy work to a module-lifetime Xe workqueue and flush it\non PCI remove so hot-unbind/rebind still waits for pending destroy work.\n\nWith queue-held device refs, guc_submit_sw_fini() cannot run with live\nGuC IDs. Replace the fini wait with an assertion and remove the unused\nfini_wq.\n\nv2:\n  - Rebase\n\nv3:\n  - Switch to queue-lifetime drm_dev_get()/drm_dev_put() model. (Matt)\n  - Queue async teardown on system_dfl_wq instead of xe->destroy_wq. (Matt)\n  - Drop separate deferred drm_dev_put worker.\n  - Remove stale drain_workqueue(xe->destroy_wq) from guc_submit_sw_fini().\n\nv4:\n  - Replace the guc_submit_sw_fini() wait with an assertion and remove\n    the now-unused fini_wq. (sashiko)\n\nv5:\n  - Move destroy work to a module-lifetime Xe workqueue instead of\n    system_dfl_wq. (Matt)\n  - Flush the module-lifetime destroy workqueue during PCI remove to\n    preserve the old device-remove wait semantics.\n\nv6:\n  - Keep SVM pagemap destroy work on the per-device destroy_wq to avoid\n    letting it outlive the xe_device/drm_device. (Sashiko)\n  - Use WQ_MEM_RECLAIM for xe->destroy_wq because SVM pagemap destroy work\n    can be queued from the reclaim path.\n\nv7:\n  - Drop the per-device xe->destroy_wq and use the module-level destroy WQ\n    for SVM pagemap destroy as well. (Matt)\n  - Rename xe_exec_queue_destroy_wq_*() helpers to xe_destroy_wq_*()\n    helpers because the WQ is no longer exec-queue specific. (Matt)\n\nv8:\n  - Rebase.\n\nv9:\n  - Keep SVM pagemap destroy work on the per-device WQ_MEM_RECLAIM\n    destroy_wq because it can be queued from reclaim and embeds\n    the dev_pagemap used by devres teardown. (Sashiko)\n  - Keep the module-level destroy WQ GuC-only and drop WQ_MEM_RECLAIM\n    from it.\n  - Update the module-WQ kdoc to document the GuC/SVM split.\n\nv10:\n  - Keep xe->destroy_wq per-cpu while adding WQ_MEM_RECLAIM to fix the\n    workqueue allocation warning.\n\nv11:\n  - Drop the SVM pagemap destroy comment as it was revision-specific.\n    (Thomas)\n\nv12:\n  - Rebase.\n\n(cherry picked from commit da1124abac689cc2b1d8995e5f0a816f8a122edb)","Type":"Description","Title":"drm/xe/guc: Hold device ref until queue teardown completes"}]}}}