CVE-2025-38036: 
Linux Kernel vulnerability analysis and mitigation

A vulnerability (CVE-2025-38036) was identified in the Linux kernel's DRM/XE virtual function (VF) component, discovered and disclosed on June 18, 2025. The issue affects the GT MMIO initialization process for reading GMDID values in the Linux kernel (NVD Database, Debian Tracker).

The vulnerability occurs when Virtual Functions (VFs) need to communicate with the GuC to obtain GMDID values. Due to recent refactoring, the gt->mmio is initialized later in the process, causing any attempt by the VF to use xe_mmio_read|write() from GuC functions to result in an NPD crash due to unset MMIO register address. This manifests as a page fault for address 0x0000000000190240 when running in SR-IOV VF mode (NVD Database).

When exploited, this vulnerability leads to system crashes in environments using the affected Linux kernel components, particularly in configurations utilizing SR-IOV VF mode for GPU virtualization (Wiz Database).

The fix involves calling xe_gt_mmio_init() to perform early setup of the gt->mmio before initializing GuC communication. This ensures that the MMIO members are properly set up before any GuC functions attempt to use them (NVD Database).