linux-cve-announce - CVE-2025-38356: drm/xe/guc: Explicitly exit CT safe mode on unwind

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025072555-CVE-2025-38356-286a@gregkh>
Date: Fri, 25 Jul 2025 14:47:57 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2025-38356: drm/xe/guc: Explicitly exit CT safe mode on unwind

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

drm/xe/guc: Explicitly exit CT safe mode on unwind

During driver probe we might be briefly using CT safe mode, which
is based on a delayed work, but usually we are able to stop this
once we have IRQ fully operational.  However, if we abort the probe
quite early then during unwind we might try to destroy the workqueue
while there is still a pending delayed work that attempts to restart
itself which triggers a WARN.

This was recently observed during unsuccessful VF initialization:

 [ ] xe 0000:00:02.1: probe with driver xe failed with error -62
 [ ] ------------[ cut here ]------------
 [ ] workqueue: cannot queue safe_mode_worker_func [xe] on wq xe-g2h-wq
 [ ] WARNING: CPU: 9 PID: 0 at kernel/workqueue.c:2257 __queue_work+0x287/0x710
 [ ] RIP: 0010:__queue_work+0x287/0x710
 [ ] Call Trace:
 [ ]  delayed_work_timer_fn+0x19/0x30
 [ ]  call_timer_fn+0xa1/0x2a0

Exit the CT safe mode on unwind to avoid that warning.

(cherry picked from commit 2ddbb73ec20b98e70a5200cb85deade22ccea2ec)

The Linux kernel CVE team has assigned CVE-2025-38356 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.11 with commit 09b286950f2911615694f4a1ff491efe9ed5eeba and fixed in 6.12.37 with commit 6d0b588614c43d6334b2d7a70a99f31f7b14ecc0
	Issue introduced in 6.11 with commit 09b286950f2911615694f4a1ff491efe9ed5eeba and fixed in 6.15.5 with commit f161e905b08ae8a513c5a36a10e3163e9920cfe6
	Issue introduced in 6.11 with commit 09b286950f2911615694f4a1ff491efe9ed5eeba and fixed in 6.16-rc4 with commit ad40098da5c3b43114d860a5b5740e7204158534

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-38356
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/gpu/drm/xe/xe_guc_ct.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/6d0b588614c43d6334b2d7a70a99f31f7b14ecc0
	https://git.kernel.org/stable/c/f161e905b08ae8a513c5a36a10e3163e9920cfe6
	https://git.kernel.org/stable/c/ad40098da5c3b43114d860a5b5740e7204158534