CVE-2026-68382 Overview
CVE-2026-68382 is a Linux kernel vulnerability in the drm/xe/guc driver that stems from a workqueue deadlock during asynchronous GuC exec queue destruction. When the final device reference is dropped from a destroy worker, the drmm cleanup path can end up draining the same workqueue that scheduled it, producing a deadlock. The flaw affects local systems using the Intel Xe graphics driver with GuC submission. Exploitation requires local access and low privileges, and impacts confidentiality, integrity, and availability of the affected host.
Critical Impact
A local attacker with low privileges can trigger a kernel deadlock in the Xe GPU driver, causing denial of service and potential memory corruption during device hot-unbind or driver teardown.
Affected Products
- Linux kernel builds including the drm/xe/guc submission driver
- Systems using Intel Xe GPU with GuC-based exec queue submission
- Distributions shipping the affected pre-patch kernel commit
Discovery Timeline
- 2026-08-10 - CVE-2026-68382 published to NVD
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-68382
Vulnerability Analysis
The vulnerability resides in the Xe DRM driver's GuC submission backend, which manages GPU command queues through Intel's Graphics microController (GuC). GuC exec queue destruction runs asynchronously via workqueue-scheduled workers. When the last reference to the drm_device is released from within a destroy worker, the managed device resource (drmm) cleanup path attempts to drain the same workqueue that currently executes the worker. This produces a self-referential wait and deadlocks the kernel task.
The fix holds a drm_device reference for the entire queue lifetime and releases it only after teardown completes. This ordering prevents drmm cleanup from running while asynchronous destroy work remains pending. The patch also relocates GuC destroy work onto a module-lifetime Xe workqueue and flushes it during PCI removal so hot-unbind and rebind operations wait for pending destroy work. The guc_submit_sw_fini() wait was replaced with an assertion, and the now-unused fini_wq was removed.
Root Cause
The root cause is a lifetime and ordering defect between asynchronous GuC destroy workers and the DRM managed cleanup subsystem. The destroy worker held no explicit reference to the parent drm_device, allowing device teardown to race and then wait on the very workqueue running the worker. This constitutes a self-deadlock condition and a kernel driver lifetime bug.
Attack Vector
Exploitation requires local access and low privileges. A local user can trigger repeated GPU workload submission and exec queue destruction, or induce device unbind/rebind cycles, to reach the deadlock window. The attack does not require user interaction and impacts confidentiality, integrity, and availability once the deadlock is hit.
No verified public exploitation code is available. See the upstream fix for technical detail in the Kernel Git Commit 03d6f83 and Kernel Git Commit 9b7e601.
Detection Methods for CVE-2026-68382
Indicators of Compromise
- Kernel task hangs or hung task warnings referencing drm_dev_put, drmm_release, or Xe destroy workers.
- dmesg entries showing stalled workers on the Xe destroy workqueue during PCI unbind or module unload.
- GPU processes stuck in uninterruptible sleep (D state) after exec queue teardown activity.
Detection Strategies
- Monitor kernel logs for repeated drm/xe workqueue drain stalls and blocked task warnings tied to GuC submission teardown paths.
- Correlate unprivileged local processes performing heavy GPU workload submission with subsequent DRM subsystem hangs.
- Track kernel version and patch level across the fleet to identify hosts running pre-fix drm/xe/guc code.
Monitoring Recommendations
- Enable hung_task_timeout_secs alerting and forward kernel logs to a centralized logging or SIEM platform for triage.
- Instrument device unbind, PCI hot-remove, and driver reload events on hosts with Intel Xe GPUs.
- Baseline normal Xe workqueue activity and alert on abnormal workqueue backlog or stuck workers.
How to Mitigate CVE-2026-68382
Immediate Actions Required
- Apply the upstream Linux kernel patches that hold a drm_device reference across GuC exec queue lifetime and move destroy work to a module-lifetime workqueue.
- Update to a distribution kernel that includes commits 03d6f83 and 9b7e601 or the cherry-picked backport da1124abac68.
- Restrict local access on multi-tenant systems that expose Intel Xe GPU devices until patches are deployed.
Patch Information
The fix is present in the mainline Linux kernel through commits 03d6f83979b0 and 9b7e60184f4b, cherry-picked from commit da1124abac689cc2b1d8995e5f0a816f8a122edb. Administrators should upgrade to a kernel release incorporating these commits or rebuild with the vendor backport.
Workarounds
- Disable or blacklist the xe kernel module on systems where the Intel Xe driver is not required until a patched kernel is available.
- Avoid driver hot-unbind and rebind operations on affected systems to reduce the likelihood of hitting the deadlock window.
- Limit local user access to GPU device nodes through group permissions and cgroup device controllers where feasible.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
