CVE-2025-68207

In the Linux kernel, the following vulnerability has been resolved: drm/xe/guc: Synchronize Dead CT worker with unbind Cancel and wait for any Dead CT worker to complete before continuing with device unbinding. Else the worker will end up using resources freed by the undind operation. (cherry picked from commit 492671339114e376aaa38626d637a2751cdef263)

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://git.kernel.org/stable/c/35959ab7d16b618616edf6df882a4533d2efe193
https://git.kernel.org/stable/c/95af8f4fdce8349a5fe75264007f1af2aa1082ea
https://git.kernel.org/stable/c/ce6ccf8e881a919bf902174ac879f80c97669498

Configurations

No configuration.

History

30 Jul 2026, 06:24

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.8

16 Dec 2025, 14:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-12-16 14:15

Updated : 2026-07-30 06:24

NVD link : CVE-2025-68207

Mitre link : CVE-2025-68207

CVE.ORG link : CVE-2025-68207

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2025-68207", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "ff6482fb458953e111a82b7c537363d9aacf04bf", "lessThan": "35959ab7d16b618616edf6df882a4533d2efe193", "versionType": "git"}, {"status": "affected", "version": "d2c5a5a926f43b2e42c5c955f917bad8ad6dd68c", "lessThan": "ce6ccf8e881a919bf902174ac879f80c97669498", "versionType": "git"}, {"status": "affected", "version": "d2c5a5a926f43b2e42c5c955f917bad8ad6dd68c", "lessThan": "95af8f4fdce8349a5fe75264007f1af2aa1082ea", "versionType": "git"}, {"status": "affected", "version": "6.12.37", "lessThan": "6.12.59", "versionType": "semver"}], "programFiles": ["drivers/gpu/drm/xe/xe_guc_ct.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.13"}, {"status": "unaffected", "version": "0", "lessThan": "6.13", "versionType": "semver"}, {"status": "unaffected", "version": "6.12.59", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.17.9", "versionType": "semver", "lessThanOrEqual": "6.17.*"}, {"status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/gpu/drm/xe/xe_guc_ct.c"], "defaultStatus": "affected"}]}], "published": "2025-12-16T14:15:53.590", "references": [{"url": "https://git.kernel.org/stable/c/35959ab7d16b618616edf6df882a4533d2efe193", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/95af8f4fdce8349a5fe75264007f1af2aa1082ea", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/ce6ccf8e881a919bf902174ac879f80c97669498", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Deferred", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/guc: Synchronize Dead CT worker with unbind\n\nCancel and wait for any Dead CT worker to complete before continuing\nwith device unbinding. Else the worker will end up using resources freed\nby the undind operation.\n\n(cherry picked from commit 492671339114e376aaa38626d637a2751cdef263)"}], "lastModified": "2026-07-30T06:24:33.380", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}