CVE-2025-68193: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68193 is a use-after-free vulnerability in the Linux kernel's drm/xe (Intel Xe GPU) driver, specifically within the GuC Command Transport Buffer (CTB) teardown logic. The flaw occurs when a buffer object (BO) allocated with the XE_BO_FLAG_GGTT_INVALIDATE flag is released prematurely before the CTB is properly disabled, leading to system crashes. It was published on December 16, 2025, and affects Linux kernel versions from the initial commit (1da177e4c3f41524e886b7f1b8a0c1fc7321cac2) up to the patched commits in stable branches (patched in 6.17.8 and 6.18) (Feedly, ENISA EUVD). No CVSS score has been assigned at this time (base score reported as 0.0), and the EPSS score is approximately 0.018% (Feedly).

The root cause is a use-after-free condition (CWE-416) in the Linux kernel's drm/xe driver. When a BO with XE_BO_FLAG_GGTT_INVALIDATE is freed, the driver attempts TLB invalidation via the CTB mechanism; however, if the CTB BO has already been released, the driver accesses freed memory. The crash manifests as a kernel oops in h2g_write() with the call trace: guc_ct_send_locked → xe_guc_ct_send_locked → send_tlb_invalidation → xe_gt_tlb_invalidation_ggtt → ggtt_node_remove → xe_ggtt_remove_bo. The fix introduces a devm-managed release action in xe_guc_ct_init() and xe_guc_ct_init_post_hwconfig() to ensure CTB is disabled before resource deallocation (Feedly, Kernel Patch 1, Kernel Patch 2).

Successful triggering of this vulnerability causes a kernel panic (system crash / oops), resulting in a denial of service on affected systems. Because this is a kernel-level use-after-free in a GPU driver, it primarily impacts availability; there is no evidence of confidentiality or integrity impact in the current disclosure. Systems running Intel Xe GPU hardware with the xe kernel driver are at risk, particularly during device teardown or driver unload sequences (Feedly).

• Logs: Kernel oops messages in /var/log/kern.log or dmesg output containing Oops: 0000 [#1] SMP NOPTI with RIP: 0010:h2g_write and a call trace involving guc_ct_send_locked, xe_guc_ct_send_locked, send_tlb_invalidation, xe_gt_tlb_invalidation_ggtt, ggtt_node_remove, xe_ggtt_node_remove, or xe_ggtt_remove_bo in the xe kernel module.
• System Behavior: Unexpected system crashes or kernel panics on hosts equipped with Intel Xe GPU hardware during driver unload or device teardown operations.

The fix has been merged into the Linux kernel stable tree. Users should update to kernel version 6.17.8 or 6.18 (or later), which include the patches at commits 52faa05fcd9f78af99abebe30a4b7b444744c991 and ee4b32220a6b41e71512e8804585325e685456ba respectively (Kernel Patch 1, Kernel Patch 2). As a workaround, systems without Intel Xe GPU hardware are not affected; administrators can also avoid loading the xe kernel module if the hardware is not required. Distribution-specific kernel updates (e.g., from Red Hat, Ubuntu, SUSE) should be applied as they become available (Feedly).