Cloudanix VulnDB

CVE-2026-68382

High · 7.8

CVSS

7.8

EPSS

0.1%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel's handling of graphics hardware resources can cause computers with certain Intel chips to freeze or crash.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Low
Impact
Full Compromise
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Race condition allowing asynchronous GuC exec queue destruction to trigger a deadlock when the final drm_device reference is released from a destroy worker, interfering with drmm cleanup on the same workqueue.

Why it matters to the business

Linux systems with Intel Xe graphics hardware may experience kernel hangs or crashes during graphics operations or device teardown, causing downtime for graphics workloads; low EPSS and no KEV listing indicate limited active exploitation risk but still require prompt kernel updates.

How an attack unfolds

A local attacker triggers GuC queue submission and destruction paths while forcing concurrent PCI remove or module unload to hit the reference counting race; the deadlock occurs because drmm cleanup drains the same workqueue used by the async destroy worker, with no known threat actors or ransomware campaigns exploiting it.

How to fix it

Upgrade the Linux kernel to a version containing the referenced fix (commit da1124abac689cc2b1d8995e5f0a816f8a122edb) that holds queue-lifetime device references, moves GuC destroy work to a module-lifetime workqueue, flushes it on PCI remove, and removes the obsolete fini_wq.

How to confirm the fix worked

Confirm the kernel source or running version incorporates the changes to guc_submit_sw_fini, xe_destroy_wq helpers, and drm_dev_get/put usage around exec queue lifetime; reproduce queue creation/destruction under concurrent unbind to verify absence of deadlock.

Typical attack path

  1. Obtain local access on an affected Linux kernel with Xe hardware
  2. Perform graphics operations that create and destroy GuC exec queues
  3. Trigger device removal or hot-unbind concurrently with queue teardown
  4. Cause the destroy worker and drmm cleanup to deadlock on the workqueue

How to detect it

Review kernel logs and dmesg for workqueue stalls, drmm cleanup warnings, or xe/guc module deadlocks during device remove; inspect crash dumps for GuC queue teardown paths overlapping with drm_device release.

What your security team should do

  • Apply kernel updates containing the GuC reference and workqueue changes as soon as available
  • Monitor kernel logs for xe/guc workqueue warnings or deadlocks on systems with Intel Xe GPUs
  • Restrict local access and graphics API usage on unpatched systems until remediation is complete

The record

In the Linux kernel, the following vulnerability has been resolved: drm/xe/guc: Hold device ref until queue teardown completes GuC exec queue destruction can run asynchronously. If the final device put happens from a destroy worker, drmm cleanup can end up draining the same workqueue and deadlock. Hold a drm_device reference for the queue lifetime and drop it after queue teardown completes. This keeps drmm cleanup from running while async destroy work is still pending. Move GuC destroy work to a module-lifetime Xe workqueue and flush it on PCI remove so hot-unbind/rebind still waits for pending destroy work. With queue-held device refs, guc_submit_sw_fini() cannot run with live GuC IDs. Replace the fini wait with an assertion and remove the unused fini_wq. v2: - Rebase v3: - Switch to queue-lifetime drm_dev_get()/drm_dev_put() model. (Matt) - Queue async teardown on system_dfl_wq instead of xe->destroy_wq. (Matt) - Drop separate deferred drm_dev_put worker. - Remove stale drain_workqueue(xe->destroy_wq) from guc_submit_sw_fini(). v4: - Replace the guc_submit_sw_fini() wait with an assertion and remove the now-unused fini_wq. (sashiko) v5: - Move destroy work to a module-lifetime Xe workqueue instead of system_dfl_wq. (Matt) - Flush the module-lifetime destroy workqueue during PCI remove to preserve the old device-remove wait semantics. v6: - Keep SVM pagemap destroy work on the per-device destroy_wq to avoid letting it outlive the xe_device/drm_device. (Sashiko) - Use WQ_MEM_RECLAIM for xe->destroy_wq because SVM pagemap destroy work can be queued from the reclaim path. v7: - Drop the per-device xe->destroy_wq and use the module-level destroy WQ for SVM pagemap destroy as well. (Matt) - Rename xe_exec_queue_destroy_wq_*() helpers to xe_destroy_wq_*() helpers because the WQ is no longer exec-queue specific. (Matt) v8: - Rebase. v9: - Keep SVM pagemap destroy work on the per-device WQ_MEM_RECLAIM destroy_wq because it can be queued from reclaim and embeds the dev_pagemap used by devres teardown. (Sashiko) - Keep the module-level destroy WQ GuC-only and drop WQ_MEM_RECLAIM from it. - Update the module-WQ kdoc to document the GuC/SVM split. v10: - Keep xe->destroy_wq per-cpu while adding WQ_MEM_RECLAIM to fix the workqueue allocation warning. v11: - Drop the SVM pagemap destroy comment as it was revision-specific. (Thomas) v12: - Rebase. (cherry picked from commit da1124abac689cc2b1d8995e5f0a816f8a122edb)

Affected packages

Ecosystem Package Introduced Fixed