{"id":"CVE-2026-68382","revision":"6b8bda5eb780435ebf262de4b6addbbf","records":[{"revision":"6b8bda5eb780435ebf262de4b6addbbf","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-68382","aliases":[],"title":"drm/xe/guc: Hold device ref until queue teardown completes","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/guc: Hold device ref until queue teardown completes\n\nGuC exec queue destruction can run asynchronously. If the final device\nput happens from a destroy worker, drmm cleanup can end up draining\nthe same workqueue and deadlock.\n\nHold a drm_device reference for the queue lifetime and drop it after\nqueue teardown completes. This keeps drmm cleanup from running while\nasync destroy work is still pending.\n\nMove GuC destroy work to a module-lifetime Xe workqueue and flush it\non PCI remove so hot-unbind/rebind still waits for pending destroy work.\n\nWith queue-held device refs, guc_submit_sw_fini() cannot run with live\nGuC IDs. Replace the fini wait with an assertion and remove the unused\nfini_wq.\n\nv2:\n  - Rebase\n\nv3:\n  - Switch to queue-lifetime drm_dev_get()/drm_dev_put() model. (Matt)\n  - Queue async teardown on system_dfl_wq instead of xe->destroy_wq. (Matt)\n  - Drop separate deferred drm_dev_put worker.\n  - Remove stale drain_workqueue(xe->destroy_wq) from guc_submit_sw_fini().\n\nv4:\n  - Replace the guc_submit_sw_fini() wait with an assertion and remove\n    the now-unused fini_wq. (sashiko)\n\nv5:\n  - Move destroy work to a module-lifetime Xe workqueue instead of\n    system_dfl_wq. (Matt)\n  - Flush the module-lifetime destroy workqueue during PCI remove to\n    preserve the old device-remove wait semantics.\n\nv6:\n  - Keep SVM pagemap destroy work on the per-device destroy_wq to avoid\n    letting it outlive the xe_device/drm_device. (Sashiko)\n  - Use WQ_MEM_RECLAIM for xe->destroy_wq because SVM pagemap destroy work\n    can be queued from the reclaim path.\n\nv7:\n  - Drop the per-device xe->destroy_wq and use the module-level destroy WQ\n    for SVM pagemap destroy as well. (Matt)\n  - Rename xe_exec_queue_destroy_wq_*() helpers to xe_destroy_wq_*()\n    helpers because the WQ is no longer exec-queue specific. (Matt)\n\nv8:\n  - Rebase.\n\nv9:\n  - Keep SVM pagemap destroy work on the per-device WQ_MEM_RECLAIM\n    destroy_wq because it can be queued from reclaim and embeds\n    the dev_pagemap used by devres teardown. (Sashiko)\n  - Keep the module-level destroy WQ GuC-only and drop WQ_MEM_RECLAIM\n    from it.\n  - Update the module-WQ kdoc to document the GuC/SVM split.\n\nv10:\n  - Keep xe->destroy_wq per-cpu while adding WQ_MEM_RECLAIM to fix the\n    workqueue allocation warning.\n\nv11:\n  - Drop the SVM pagemap destroy comment as it was revision-specific.\n    (Thomas)\n\nv12:\n  - Rebase.\n\n(cherry picked from commit da1124abac689cc2b1d8995e5f0a816f8a122edb)","state":0,"publishedAt":"2026-08-10T12:04:01.187+00:00","modifiedAt":"2026-10-19T21:09:07.083+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/gpu/drm/xe/xe_device.c\",\n                        \"drivers/gpu/drm/xe/xe_device_types.h\",\n                        \"drivers/gpu/drm/xe/xe_guc_submit.c\",\n                        \"drivers/gpu/drm/xe/xe_guc_types.h\",\n                        \"drivers/gpu/drm/xe/xe_module.c\",\n                        \"drivers/gpu/drm/xe/xe_module.h\",\n                        \"drivers/gpu/drm/xe/xe_pci.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"2d2be279f1ca9e7288282d4214f16eea8a727cdb\",\n                            \"lessThan\": \"81f70f130eff985fb678d8b891c960381bc7e900\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"2d2be279f1ca9e7288282d4214f16eea8a727cdb\",\n                            \"lessThan\": \"03d6f83979b0d75a0b0893dfe1735ec93facf515\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"2d2be279f1ca9e7288282d4214f16eea8a727cdb\",\n                            \"lessThan\": \"9b7e60184f4b22e893d4ae95234d5f26261a430c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"272b0e78874586d6ccae04079d75b27b47705544\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"421c74670b0f9d5c007f1276d3647aa58f407fde\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"6.10.14\",\n                            \"lessThan\": \"6.11\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.11.3\",\n                            \"lessThan\": \"6.12\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/gpu/drm/xe/xe_device.c\",\n                        \"drivers/gpu/drm/xe/xe_device_types.h\",\n                        \"drivers/gpu/drm/xe/xe_guc_submit.c\",\n                        \"drivers/gpu/drm/xe/xe_guc_types.h\",\n                        \"drivers/gpu/drm/xe/xe_module.c\",\n                        \"drivers/gpu/drm/xe/xe_module.h\",\n                        \"drivers/gpu/drm/xe/xe_pci.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.12\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.12\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.57\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1.6\",\n                            \"lessThanOrEqual\": \"7.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/81f70f130eff985fb678d8b891c960381bc7e900","https://git.kernel.org/stable/c/03d6f83979b0d75a0b0893dfe1735ec93facf515","https://git.kernel.org/stable/c/9b7e60184f4b22e893d4ae95234d5f26261a430c"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-68382","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-68382","identifiers":["CVE-2026-68382"]},"retained":false,"historicalAffected":[]}],"coverage":[]}