CVE-2025-39811

What it actually does

Failure to clear an error-valued scratch_pt pointer before cleanup allows xe_vm_free_scratch() to dereference an error pointer, resulting in invalid memory access during VM teardown in the Linux kernel DRM/XE driver.

Why it matters to the business

Systems running affected Linux kernels with Intel Xe graphics may experience kernel panics or crashes during graphics or virtual machine operations, leading to downtime and potential data loss in containerized or virtualized environments.

How an attack unfolds

An attacker triggers error conditions during VM scratch page table allocation in the DRM/XE subsystem; on subsequent cleanup the uncleared error pointer is dereferenced, allowing local privilege escalation or denial of service. VMSCAPE actors and similar container-focused campaigns have targeted related Linux kernel memory issues for container escape.

How to fix it

Update to the fixed commits listed for each branch (c8277d229c7840e8090d4704e50f2ca014d194c7 or equivalent stable backports); Debian packages noweb 2.10c-3.1 and later contain the correction. Reboot after kernel upgrade.

How to confirm the fix worked

Confirm the running kernel contains commit 358ee50ab565f3c8ea32480e9d03127a81ba32f8 or the stable equivalent c8277d229c7840e8090d4704e50f2ca014d194c7; inspect xe_vm.c for the pointer-clearing change in xe_vm_free_scratch.

Typical attack path

1. Obtain local access or container breakout on a system using the vulnerable kernel
2. Trigger allocation failure paths in drm/xe VM scratch page table setup
3. Force xe_vm_free_scratch cleanup while scratch_pt still holds an error pointer
4. Dereference causes kernel fault or exploitable memory corruption

How to detect it

Search kernel logs for Xe driver oops or panic messages referencing xe_vm_free_scratch or scratch_pt; correlate with process creation of graphics or container workloads around the crash time. Review audit logs for unexpected privilege changes after such events.

What your security team should do

• Prioritize kernel upgrades on systems with Intel Xe graphics or DRM/XE enabled
• Monitor for container escape attempts given VMSCAPE actor interest in similar kernel flaws
• Apply updates before the CISA-style deadlines if the package appears in internal inventories
• Re-test graphics and VM workloads after patching to ensure stability