{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2026-68382",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2026-68382",
    "idYear": 2026,
    "status": "PUBLISHED",
    "publishedAt": "2026-08-10T12:04:01.187Z",
    "updatedAt": "2026-10-19T21:09:07.083Z",
    "importedAt": "2026-10-24T01:58:25.636Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "drm/xe/guc: Hold device ref until queue teardown completes",
      "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/guc: Hold device ref until queue teardown completes\n\nGuC exec queue destruction can run asynchronously. If the final device\nput happens from a destroy worker, drmm cleanup can end up draining\nthe same workqueue and deadlock.\n\nHold a drm_device reference for the queue lifetime and drop it after\nqueue teardown completes. This keeps drmm cleanup from running while\nasync destroy work is still pending.\n\nMove GuC destroy work to a module-lifetime Xe workqueue and flush it\non PCI remove so hot-unbind/rebind still waits for pending destroy work.\n\nWith queue-held device refs, guc_submit_sw_fini() cannot run with live\nGuC IDs. Replace the fini wait with an assertion and remove the unused\nfini_wq.\n\nv2:\n  - Rebase\n\nv3:\n  - Switch to queue-lifetime drm_dev_get()/drm_dev_put() model. (Matt)\n  - Queue async teardown on system_dfl_wq instead of xe->destroy_wq. (Matt)\n  - Drop separate deferred drm_dev_put worker.\n  - Remove stale drain_workqueue(xe->destroy_wq) from guc_submit_sw_fini().\n\nv4:\n  - Replace the guc_submit_sw_fini() wait with an assertion and remove\n    the now-unused fini_wq. (sashiko)\n\nv5:\n  - Move destroy work to a module-lifetime Xe workqueue instead of\n    system_dfl_wq. (Matt)\n  - Flush the module-lifetime destroy workqueue during PCI remove to\n    preserve the old device-remove wait semantics.\n\nv6:\n  - Keep SVM pagemap destroy work on the per-device destroy_wq to avoid\n    letting it outlive the xe_device/drm_device. (Sashiko)\n  - Use WQ_MEM_RECLAIM for xe->destroy_wq because SVM pagemap destroy work\n    can be queued from the reclaim path.\n\nv7:\n  - Drop the per-device xe->destroy_wq and use the module-level destroy WQ\n    for SVM pagemap destroy as well. (Matt)\n  - Rename xe_exec_queue_destroy_wq_*() helpers to xe_destroy_wq_*()\n    helpers because the WQ is no longer exec-queue specific. (Matt)\n\nv8:\n  - Rebase.\n\nv9:\n  - Keep SVM pagemap destroy work on the per-device WQ_MEM_RECLAIM\n    destroy_wq because it can be queued from reclaim and embeds\n    the dev_pagemap used by devres teardown. (Sashiko)\n  - Keep the module-level destroy WQ GuC-only and drop WQ_MEM_RECLAIM\n    from it.\n  - Update the module-WQ kdoc to document the GuC/SVM split.\n\nv10:\n  - Keep xe->destroy_wq per-cpu while adding WQ_MEM_RECLAIM to fix the\n    workqueue allocation warning.\n\nv11:\n  - Drop the SVM pagemap destroy comment as it was revision-specific.\n    (Thomas)\n\nv12:\n  - Rebase.\n\n(cherry picked from commit da1124abac689cc2b1d8995e5f0a816f8a122edb)",
      "affected": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "2d2be279f1ca9e7288282d4214f16eea8a727cdb",
              "status": "affected",
              "versionType": "git",
              "lessThan": "81f70f130eff985fb678d8b891c960381bc7e900"
            },
            {
              "version": "2d2be279f1ca9e7288282d4214f16eea8a727cdb",
              "status": "affected",
              "versionType": "git",
              "lessThan": "03d6f83979b0d75a0b0893dfe1735ec93facf515"
            },
            {
              "version": "2d2be279f1ca9e7288282d4214f16eea8a727cdb",
              "status": "affected",
              "versionType": "git",
              "lessThan": "9b7e60184f4b22e893d4ae95234d5f26261a430c"
            },
            {
              "version": "272b0e78874586d6ccae04079d75b27b47705544",
              "status": "affected",
              "versionType": "git"
            },
            {
              "version": "421c74670b0f9d5c007f1276d3647aa58f407fde",
              "status": "affected",
              "versionType": "git"
            },
            {
              "version": "6.10.14",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "6.11"
            },
            {
              "version": "6.11.3",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "6.12"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "versions": [
            {
              "version": "6.12",
              "status": "affected"
            },
            {
              "version": "0",
              "status": "unaffected",
              "versionType": "semver",
              "lessThan": "6.12"
            },
            {
              "version": "6.18.57",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "version": "7.1.6",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "7.1.*"
            },
            {
              "version": "7.2",
              "status": "unaffected",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ]
        }
      ]
    }
  }
}