CVE-2025-68207

What it actually does

Use-after-free in the Linux kernel DRM/XE GuC component where a pending Dead CT worker accesses resources that have been freed during device unbind.

Why it matters to the business

Systems running affected Linux kernels with Xe graphics may experience crashes, data corruption, or potential privilege escalation; widespread kernel and container runtime deployments increase exposure across servers and containers, though low exploit likelihood reduces immediate operational risk.

How an attack unfolds

An attacker with local access triggers device unbind operations while a Dead CT worker is queued, causing the worker to dereference already-freed memory structures after the unbind completes.

How to fix it

Upgrade Linux kernel to version 6.12.59 or later; update Chainguard containerd-fips, containerd-shim-runc-v2-fips, containerd-stress-fips, and ctr-fips to 2.0.2-r2; apply the git commit 35959ab7d16b618616edf6df882a4533d2efe193 or equivalent stable patches.

How to confirm the fix worked

Verify running kernel version against 6.12.59 or fixed commit; confirm containerd package versions match 2.0.2-r2; review dmesg or kernel logs for GuC-related warnings during unbind sequences.

Typical attack path

1. Obtain local access on a system using an affected Linux kernel with Xe graphics hardware.
2. Trigger or force a device unbind event while a Dead CT worker is pending.
3. The worker executes after resources are freed, resulting in use-after-free access.
4. Leverage the resulting memory corruption for denial of service or escalation.

How to detect it

Review kernel logs and dmesg for GuC Dead CT worker errors coinciding with unbind operations; examine audit logs for unusual device detach events on graphics hardware; no widespread exploitation artifacts reported.

What your security team should do

• Prioritize kernel updates on systems with Xe graphics within standard patch windows given low EPSS and absence from KEV.
• Audit container environments for Chainguard packages and apply 2.0.2-r2 updates.
• Monitor for future EPSS increases or exploit maturity reports over the next 30 days.
• Include the fix in routine kernel maintenance cycles for all downstream dependents.