Linux kernel drm/xe GuC: async exec queue destruction can deadlock drmm cleanup on device removal
Impact
GuC exec queue destruction runs asynchronously; if the final device put happens from the destroy worker, drmm cleanup drains the same workqueue and deadlocks. The practical exposure is a hung PCI remove or driver unbind on an Intel Xe host - a GPU node that will not release the device and in most cases has to be rebooted rather than recovered. This is an availability and maintainability problem on the fleet, not a tenant isolation break; nothing in the record indicates a memory-disclosure or escalation path despite the high CVSS attached to the kernel CNA's default scoring.
Who can reach it
Local and administrative: reached through device unbind, hot-unplug, or driver rebind while queue destroy work is pending. Not reachable by an unprivileged tenant on its own.
What to do
Apply the stable fix that holds a drm_device reference for the queue lifetime and moves destroy work to a module-lifetime workqueue flushed on PCI remove; reboot the node to pick it up. Until then, treat xe driver unbind/rebind as an operation that may require a reboot to clear.
References
Related entries
- Linux kernel drm/xe GuC: scheduler keeps a pointer to the exec queue name freed with the queueCVE-2026-68383 · Linux kernel drm/xe GuC submission (scheduler timeline name)High
- Linux kernel drm/xe VF: CCS batch buffers attached/detached without waiting for in-flight BO copyCVE-2026-68384 · Linux kernel drm/xe SR-IOV VF (CCS metadata batch buffers on BO move)High
- Linux kernel vmwgfx: surface array_size taken from userspace without a shader-model boundCVE-2026-68446 · Linux kernel drm/vmwgfx (vmw_surface_metadata::array_size validation)High
- Linux kernel dma-fence: zero-count dedup returns 1, letting amdgpu user-queue waits read an uninitialized fenceCVE-2026-72095 · Linux kernel dma-fence (dma_fence_dedup_array zero-count handling, amdgpu user queues)High
- NVIDIA/Mellanox ConnectX driver (mlx5_ib user access region index release): The driver released the software-side UARCVE-2026-74296 · NVIDIA/Mellanox ConnectX driver (mlx5_ib user access region index release)High
- Linux kernel amdgpu RAS / GPU reset and recovery path (drm/amdgpu): An out-of-bounds access in the amdgpu RAS / GPUCVE-2026-74357 · Linux kernel amdgpu RAS / GPU reset and recovery path (drm/amdgpu)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.