CVE-2025-68193

What it actually does

Use-after-free in the Xe GPU driver allows a buffer object allocated with XE_BO_FLAG_GGTT_INVALIDATE to be released while TLB invalidation requests are still in flight through the CTB mechanism, resulting in a NULL dereference during h2g_write.

Why it matters to the business

Systems running affected Linux kernels with Intel Xe graphics may experience kernel crashes and reboots when graphics memory is freed, disrupting workloads that rely on the GPU and requiring urgent patching across fleets of servers and workstations.

How an attack unfolds

An attacker with local access triggers repeated allocation and release of GGTT-invalidated buffer objects, causing the CTB to be torn down while send_tlb_invalidation still holds references; this leads to a crash during ggtt_node_remove. No widespread in-the-wild exploitation has been observed.

How to fix it

Update the Linux kernel to commit 52faa05fcd9f78af99abebe30a4b7b444744c991 or later stable releases that include the devm-managed CT release action in xe_guc_ct_init and xe_guc_ct_init_post_hwconfig.

How to confirm the fix worked

Confirm the running kernel contains commit 52faa05fcd9f78af99abebe30a4b7b444744c991; exercise xe_ggtt_remove_bo paths under memory pressure and verify no Oops involving h2g_write or guc_ct_send_locked occurs.

Typical attack path

1. Obtain local unprivileged access to a system with an affected Xe GPU driver
2. Allocate multiple buffer objects using XE_BO_FLAG_GGTT_INVALIDATE
3. Force rapid deallocation paths that invoke xe_ggtt_remove_bo while CTB requests remain pending
4. Trigger the use-after-free in h2g_write during TLB invalidation

How to detect it

Search kernel logs for Oops strings containing h2g_write, guc_ct_send_locked, send_tlb_invalidation, or xe_ggtt_remove_bo; correlate with processes performing frequent GPU buffer allocations immediately before the crash.

What your security team should do

• Prioritize kernel upgrades on all systems exposing Intel Xe GPUs within the CISA remediation window
• Enable kernel panic-on-oops and central logging to detect crashes during graphics teardown
• Restrict unprivileged local access on multi-tenant systems until patches are applied
• Monitor EPSS trend and re-evaluate if exploit maturity increases