CVE-2025-38353: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38353 is a vulnerability discovered in the Linux kernel, specifically affecting the drm/xe driver component. The issue was disclosed on July 25, 2025, and involves an invalid lock condition that occurs during device wedge situations, particularly during GuC upload when submission is not enabled and the state is not initialized (NVD, Red Hat).

The vulnerability manifests when a device wedges during GuC upload, where the submission is not yet enabled and the state remains uninitialized. This condition triggers an invalid lock attempt, resulting in a kernel warning and potential system instability. The issue has been assigned a CVSS v3.1 base score of 7.0 with the vector string CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a moderate severity level (Red Hat).

The vulnerability affects Red Hat Enterprise Linux 9 and Red Hat Enterprise Linux 10, specifically impacting their kernel and kernel-rt packages. Earlier versions of Red Hat Enterprise Linux (6, 7, and 8) are not affected by this vulnerability (Red Hat).

A fix has been implemented to protect the wedge call by preventing its execution when the system state is not properly initialized. The solution addresses the splat issue that was occurring during device wedge situations (NVD).