CVE-2025-40166

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-40166", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.176Z", "datePublished": "2025-11-12T10:26:24.143Z", "dateUpdated": "2026-08-05T12:08:11.302Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:08:11.302Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/guc: Check GuC running state before deregistering exec queue\n\nIn normal operation, a registered exec queue is disabled and\nderegistered through the GuC, and freed only after the GuC confirms\ncompletion. However, if the driver is forced to unbind while the exec\nqueue is still running, the user may call exec_destroy() after the GuC\nhas already been stopped and CT communication disabled.\n\nIn this case, the driver cannot receive a response from the GuC,\npreventing proper cleanup of exec queue resources. Fix this by directly\nreleasing the resources when GuC is not running.\n\nHere is the failure dmesg log:\n\"\n[ 468.089581] ---[ end trace 0000000000000000 ]---\n[ 468.089608] pci 0000:03:00.0: [drm] *ERROR* GT0: GUC ID manager unclean (1/65535)\n[ 468.090558] pci 0000:03:00.0: [drm] GT0: total 65535\n[ 468.090562] pci 0000:03:00.0: [drm] GT0: used 1\n[ 468.090564] pci 0000:03:00.0: [drm] GT0: range 1..1 (1)\n[ 468.092716] ------------[ cut here ]------------\n[ 468.092719] WARNING: CPU: 14 PID: 4775 at drivers/gpu/drm/xe/xe_ttm_vram_mgr.c:298 ttm_vram_mgr_fini+0xf8/0x130 [xe]\n\"\n\nv2: use xe_uc_fw_is_running() instead of xe_guc_ct_enabled().\n As CT may go down and come back during VF migration.\n\n(cherry picked from commit 9b42321a02c50a12b2beb6ae9469606257fbecea)"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable code is reached only through the local DRM character device \u2014 `ioctl(DRM_IOCTL_XE_EXEC_QUEUE_DESTROY)` on `/dev/dri/renderD*` or closing that fd via `xe_file_close()`; no network or adjacent-network input feeds `__guc_exec_queue_process_msg_cleanup()`.\nAC:L - There is no race for the attacker to win \u2014 once the GuC firmware is no longer marked running (driver unbind, PCI hot-unplug of a Thunderbolt/USB4 eGPU, FLR-based shutdown, or CT teardown), every cleanup of a still-registered exec queue deterministically takes the broken `disable_scheduling_deregister()` branch, and the attacker simply keeps a submitted exec queue alive so its destruction lands in that window.\nPR:L - `XE_EXEC_QUEUE_DESTROY` and `XE_EXEC_QUEUE_CREATE` are registered with `DRM_RENDER_ALLOW` and perform no capability check, so any unprivileged local account in the `render`/`video` group \u2014 including a container or sandbox given `/dev/dri` passthrough \u2014 can create and destroy exec queues.\nUI:N - The triggering action is entirely the attacker's own \u2014 an `exec_destroy()` ioctl or simply exiting the process so `xe_file_close()` tears down its queues \u2014 and the device-teardown side occurs on ordinary system events (shutdown/FLR, hot-unplug, driver reload) rather than requiring a separate victim to perform an action.\nS:U - The leaked exec queue, stale GuC IDs, dangling TTM VRAM manager and subsequent stale-work dereferences are all confined to the host kernel's own memory and the same security authority; no hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - Because `__guc_exec_queue_destroy_async()` \u2014 explicitly commented \"Confirm no work left behind accessing device structures\" \u2014 never runs, the DRM scheduler's `work_tdr` delayed work stays armed on a leaked `xe_guc_exec_queue` and later dereferences the drmm-freed `xe_device`/`xe_gt`/`xe_guc`, a use-after-free read of reclaimed kernel memory that an attacker can groom with heap spraying; the leaked LRC/ring VRAM objects are likewise never scrubbed or returned to the allocator.\nI:H - The same never-cancelled TDR work and never-fini'd `drm_gpu_scheduler`/entity fire against freed device structures \u2014 and after `rmmod xe` against freed module text \u2014 giving a write and control-flow hijack primitive over reclaimed memory, while `ttm_vram_mgr_fini()`'s early return leaves a stale `ttm_resource_manager` pointer registered in the freed `xe_device`.\nA:H - The bug reliably produces kernel WARN/assert splats (`xe_gt_assert` in `guc_submit_fini()` and `WARN_ON_ONCE` in `ttm_vram_mgr_fini()`, fatal on `panic_on_warn` systems), permanently leaks GuC IDs and VRAM so the GPU cannot be rebound without a reboot, and leaves `xe_drm_client_fdinfo()`'s untimed `wait_var_event()` on `pending_removal` blocking forever, producing an unkillable uninterruptible-sleep task."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/xe/xe_guc_submit.c"], "versions": [{"version": "dd08ebf6c3525a7ea2186e636df064ea47281987", "lessThan": "2c6e5904c5bdbac8e0eadee40f70c42bb83f6dc6", "status": "affected", "versionType": "git"}, {"version": "dd08ebf6c3525a7ea2186e636df064ea47281987", "lessThan": "fa708415566bbe5361c935645107319f8edc8dc1", "status": "affected", "versionType": "git"}, {"version": "dd08ebf6c3525a7ea2186e636df064ea47281987", "lessThan": "9f64b3cd051b825de0a2a9f145c8e003200cedd5", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/xe/xe_guc_submit.c"], "versions": [{"version": "6.8", "status": "affected"}, {"version": "0", "lessThan": "6.8", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.55", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.17.5", "lessThanOrEqual": "6.17.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.12.55"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.17.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.18"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/2c6e5904c5bdbac8e0eadee40f70c42bb83f6dc6"}, {"url": "https://git.kernel.org/stable/c/fa708415566bbe5361c935645107319f8edc8dc1"}, {"url": "https://git.kernel.org/stable/c/9f64b3cd051b825de0a2a9f145c8e003200cedd5"}], "title": "drm/xe/guc: Check GuC running state before deregistering exec queue", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/xe/xe_guc_submit.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "2c6e5904c5bdbac8e0eadee40f70c42bb83f6dc6", "status": "affected", "version": "dd08ebf6c3525a7ea2186e636df064ea47281987", "versionType": "git"}, {"lessThan": "fa708415566bbe5361c935645107319f8edc8dc1", "status": "affected", "version": "dd08ebf6c3525a7ea2186e636df064ea47281987", "versionType": "git"}, {"lessThan": "9f64b3cd051b825de0a2a9f145c8e003200cedd5", "status": "affected", "version": "dd08ebf6c3525a7ea2186e636df064ea47281987", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/xe/xe_guc_submit.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.8"}, {"lessThan": "6.8", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.55", "versionType": "semver"}, {"lessThanOrEqual": "6.17.*", "status": "unaffected", "version": "6.17.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/guc: Check GuC running state before deregistering exec queue\n\nIn normal operation, a registered exec queue is disabled and\nderegistered through the GuC, and freed only after the GuC confirms\ncompletion. However, if the driver is forced to unbind while the exec\nqueue is still running, the user may call exec_destroy() after the GuC\nhas already been stopped and CT communication disabled.\n\nIn this case, the driver cannot receive a response from the GuC,\npreventing proper cleanup of exec queue resources. Fix this by directly\nreleasing the resources when GuC is not running.\n\nHere is the failure dmesg log:\n\"\n[ 468.089581] ---[ end trace 0000000000000000 ]---\n[ 468.089608] pci 0000:03:00.0: [drm] *ERROR* GT0: GUC ID manager unclean (1/65535)\n[ 468.090558] pci 0000:03:00.0: [drm] GT0: total 65535\n[ 468.090562] pci 0000:03:00.0: [drm] GT0: used 1\n[ 468.090564] pci 0000:03:00.0: [drm] GT0: range 1..1 (1)\n[ 468.092716] ------------[ cut here ]------------\n[ 468.092719] WARNING: CPU: 14 PID: 4775 at drivers/gpu/drm/xe/xe_ttm_vram_mgr.c:298 ttm_vram_mgr_fini+0xf8/0x130 [xe]\n\"\n\nv2: use xe_uc_fw_is_running() instead of xe_guc_ct_enabled().\n As CT may go down and come back during VF migration.\n\n(cherry picked from commit 9b42321a02c50a12b2beb6ae9469606257fbecea)"}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndrm/xe/guc: Verificar el estado de ejecuci\u00f3n de GuC antes de anular el registro de la cola de ejecuci\u00f3n\n\nEn operaci\u00f3n normal, una cola de ejecuci\u00f3n registrada se deshabilita y se anula su registro a trav\u00e9s del GuC, y se libera solo despu\u00e9s de que el GuC confirma la finalizaci\u00f3n. Sin embargo, si el controlador se ve obligado a desvincularse mientras la cola de ejecuci\u00f3n a\u00fan est\u00e1 en ejecuci\u00f3n, el usuario puede llamar a exec_destroy() despu\u00e9s de que el GuC ya se haya detenido y la comunicaci\u00f3n CT se haya deshabilitado.\n\nEn este caso, el controlador no puede recibir una respuesta del GuC, lo que impide una limpieza adecuada de los recursos de la cola de ejecuci\u00f3n. Solucione esto liberando directamente los recursos cuando GuC no est\u00e1 en ejecuci\u00f3n.\n\nAqu\u00ed est\u00e1 el registro dmesg del fallo:\n\u201c\n[ 468.089581] ---[ end trace 0000000000000000 ]---\n[ 468.089608] pci 0000:03:00.0: [drm] *ERROR* GT0: GUC ID manager unclean (1/65535)\n[ 468.090558] pci 0000:03:00.0: [drm] GT0: total 65535\n[ 468.090562] pci 0000:03:00.0: [drm] GT0: used 1\n[ 468.090564] pci 0000:03:00.0: [drm] GT0: range 1..1 (1)\n[ 468.092716] ------------[ cut here ]------------\n[ 468.092719] WARNING: CPU: 14 PID: 4775 at drivers/gpu/drm/xe/xe_ttm_vram_mgr.c:298 ttm_vram_mgr_fini+0xf8/0x130 [xe]\n\u201d\n\nv2: usar xe_uc_fw_is_running() en lugar de xe_guc_ct_enabled().\n Ya que CT puede caerse y volver durante la migraci\u00f3n de VF.\n\n(seleccionado de la confirmaci\u00f3n 9b42321a02c50a12b2beb6ae9469606257fbecea)"}], "id": "CVE-2025-40166", "lastModified": "2026-10-19T21:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2025-11-12T11:15:46.880", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2c6e5904c5bdbac8e0eadee40f70c42bb83f6dc6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9f64b3cd051b825de0a2a9f145c8e003200cedd5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/fa708415566bbe5361c935645107319f8edc8dc1"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Deferred"}

{"bugzilla": {"description": "kernel: drm/xe/guc: Check GuC running state before deregistering exec queue", "id": "2414485", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2414485"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\ndrm/xe/guc: Check GuC running state before deregistering exec queue\nIn normal operation, a registered exec queue is disabled and\nderegistered through the GuC, and freed only after the GuC confirms\ncompletion. However, if the driver is forced to unbind while the exec\nqueue is still running, the user may call exec_destroy() after the GuC\nhas already been stopped and CT communication disabled.\nIn this case, the driver cannot receive a response from the GuC,\npreventing proper cleanup of exec queue resources. Fix this by directly\nreleasing the resources when GuC is not running.\nHere is the failure dmesg log:\n\"\n[ 468.089581] ---[ end trace 0000000000000000 ]---\n[ 468.089608] pci 0000:03:00.0: [drm] *ERROR* GT0: GUC ID manager unclean (1/65535)\n[ 468.090558] pci 0000:03:00.0: [drm] GT0: total 65535\n[ 468.090562] pci 0000:03:00.0: [drm] GT0: used 1\n[ 468.090564] pci 0000:03:00.0: [drm] GT0: range 1..1 (1)\n[ 468.092716] ------------[ cut here ]------------\n[ 468.092719] WARNING: CPU: 14 PID: 4775 at drivers/gpu/drm/xe/xe_ttm_vram_mgr.c:298 ttm_vram_mgr_fini+0xf8/0x130 [xe]\n\"\nv2: use xe_uc_fw_is_running() instead of xe_guc_ct_enabled().\nAs CT may go down and come back during VF migration.\n(cherry picked from commit 9b42321a02c50a12b2beb6ae9469606257fbecea)"], "name": "CVE-2025-40166", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-11-12T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-40166\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-40166\nhttps://lore.kernel.org/linux-cve-announce/2025111228-CVE-2025-40166-07ed@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-11-12T22:12:16.339709+00:00", "updated": "2025-11-12T22:12:16.339747+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}