Skip to main content

Linux Kernel CVE-2025-68207

HIGH
2025-12-16 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
High
Disputed · 7.8 Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Sources disagree (Low–High)
Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Local race condition needing driver-unbind privilege (AV:L/PR:L) and winning a timing window (AC:H raised from source's AC:L); use-after-free yields full CIA impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 LOW
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 30, 2026 - 07:23 vuln.today
CVE Published
Dec 16, 2025 - 14:15 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/xe/guc: Synchronize Dead CT worker with unbind

Cancel and wait for any Dead CT worker to complete before continuing with device unbinding. Else the worker will end up using resources freed by the undind operation.

(cherry picked from commit 492671339114e376aaa38626d637a2751cdef263)

AnalysisAI

Local privilege escalation and memory corruption in the Linux kernel's Intel Xe GPU driver (drm/xe/guc) arises from a use-after-free race during device unbind: the GuC 'Dead CT' worker is not synchronized with the unbind path, so it can access GuC communication-transport resources after they have already been freed. Exploitation requires local access with low privileges (CVSS 7.8, AV:L/PR:L) and can result in high impact to confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and the low EPSS (0.17%) reflects the niche, timing-dependent nature of the flaw.

Technical ContextAI

The affected component is the DRM (Direct Rendering Manager) subsystem's Xe driver, which supports Intel discrete and integrated Xe-architecture GPUs. The 'CT' refers to the GuC (Graphics micro-Controller) CTB/Command Transport buffers used for host-to-firmware communication. When the GuC firmware enters a dead/hung state, a 'Dead CT' worker is scheduled asynchronously to handle recovery/reporting. The bug is a lifetime/synchronization defect (a use-after-free of the CWE-416 / CWE-362 race-condition class; NVD lists CWE as N/A): the device unbind (driver detach/removal) frees resources the worker still references because unbind does not cancel and flush that worker first. The fix (commit 4926713... cherry-picked to stable, with references 35959ab7, 95af8f4f, ce6ccf8e) adds a cancel-and-wait so the worker completes before resources are torn down.

Affected ProductsAI

The Linux kernel is affected, specifically builds that include the drm/xe GuC driver (Intel Xe GPU support, introduced in recent mainline kernels). Exact affected version ranges are not enumerated in the provided data; the three git.kernel.org stable references (https://git.kernel.org/stable/c/35959ab7d16b618616edf6df882a4533d2efe193, https://git.kernel.org/stable/c/95af8f4fdce8349a5fe75264007f1af2aa1082ea, https://git.kernel.org/stable/c/ce6ccf8e881a919bf902174ac879f80c97669498) indicate the fix was backported to multiple stable branches, implying several stable series were vulnerable. No CPE strings were provided. Distributions shipping the Xe driver (recent Fedora, Ubuntu, and enterprise kernels with Intel Xe support) should be considered in scope.

RemediationAI

Upstream fix available (commit 492671339114e376aaa38626d637a2751cdef263, cherry-picked to stable via commits 35959ab7d16b, 95af8f4fdce8, and ce6ccf8e881a); a released patched tagged kernel version is not independently confirmed from the provided data, so update to your distribution's latest patched kernel that incorporates these stable commits (see https://git.kernel.org/stable/c/35959ab7d16b618616edf6df882a4533d2efe193 and the two companion references). As a compensating control until patched, restrict the ability to unbind/rebind the Xe GPU driver by limiting access to sysfs unbind interfaces (/sys/bus/pci/drivers/xe/unbind) to root only and avoiding automated driver hot-unbind workflows; the trade-off is that legitimate GPU hot-reset/reload operations become restricted. On systems that do not require the Xe driver, unloading or blacklisting the xe module removes the exposure entirely at the cost of losing Intel Xe GPU acceleration.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.0/base-os-container:latest Container suse/sl-micro/6.0/kvm-os-container:latest Container suse/sl-micro/6.0/rt-os-container:latest Image SL-Micro Affected
Container suse/sl-micro/6.0/toolbox:latest Affected
Image SLES-Azure-3P Image SLES-Azure-Basic Image SLES-Azure-Standard Image SLES-BYOS-Azure Image SLES-BYOS-EC2 Image SLES-BYOS-GCE Image SLES-CHOST-BYOS-Aliyun Image SLES-CHOST-BYOS-Azure Image SLES-CHOST-BYOS-EC2 Image SLES-CHOST-BYOS-GCE Image SLES-CHOST-BYOS-GDC Image SLES-CHOST-BYOS-SAP-CCloud Image SLES-EC2 Image SLES-EC2-ECS Image SLES-GCE Image SLES-GCE-3P Image SLES-Hardened-BYOS-Azure Image SLES-Hardened-BYOS-EC2 Image SLES-Hardened-BYOS-GCE Image SLES-SAPCAL-Azure Image SLES-SAPCAL-EC2 Image SLES-SAPCAL-GCE Affected
Image SLES-SAP-Azure Image SLES-SAP-Azure-3P Image SLES-SAP-BYOS-Azure Image SLES-SAP-BYOS-EC2 Image SLES-SAP-BYOS-GCE Image SLES-SAP-EC2 Image SLES-SAP-GCE Image SLES-SAP-GCE-3P Affected
Image SLES15-SP7-Azure-3P Image SLES15-SP7-Azure-Basic Image SLES15-SP7-Azure-Standard Image SLES15-SP7-HPC-Azure Affected

Share

CVE-2025-68207 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy