CVE-2025-68326: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68326 is a NULL pointer dereference vulnerability in the Linux kernel's DRM (Direct Rendering Manager) Xe GPU driver, specifically in the GuC (Graphics Micro Controller) component. The flaw arises from a missing stack_depot_init() call when the CONFIG_DRM_XE_DEBUG_GUC kernel configuration option is enabled, triggering a kernel crash during GPU workqueue processing. It was disclosed on December 22, 2025, and affects Linux kernel versions in the range 16b7e65d299d through 0e234632e39b (one stable branch) and 16b7e65d299d through 1966838d1c82 (another), with patches available for kernel 6.17.11 and 6.18 (Red Hat Advisory, Red Hat Bugzilla). The CVSS v3.1 base score is 5.5 (Medium), reflecting a local attack vector with low privileges required and high availability impact (Red Hat Advisory).

The root cause is a missing initialization call — stack_depot_init() is never invoked before stack_depot_save_flags() is called within the fast_req_track() function of the Xe GuC driver when CONFIG_DRM_XE_DEBUG_GUC is enabled (CWE: NULL Pointer Dereference). When a GPU scheduling workqueue (drm_sched_run_job_work) triggers fast_req_track, the uninitialized stack depot results in a dereference of address 0x0000000000000000, causing a kernel BUG. Exploitation requires local access to a system with an Intel Xe GPU and the debug configuration option enabled, limiting the attack surface primarily to development or debug-configured systems (Red Hat Bugzilla, Red Hat Advisory). The upstream fix (commit 64fdf496a692) adds the missing stack_depot_init() call and was cherry-picked into stable kernel branches (Red Hat Bugzilla).

Successful exploitation causes a kernel NULL pointer dereference, resulting in a system crash (kernel panic) and denial of service. The vulnerability has no impact on confidentiality or data integrity — only system availability is affected. Because the crash occurs in kernel space, it brings down the entire system rather than just a single process, potentially disrupting all services running on the affected host (Red Hat Advisory).

Apply the upstream kernel patch (commit 64fdf496a692) available in stable kernel versions 6.17.11 and 6.18, or via distribution-specific updates such as Ubuntu Security Notice USN-8094-1 through USN-8094-5 (Ubuntu USN-8094-1, Ubuntu USN-8094-5). As a workaround, disable CONFIG_DRM_XE_DEBUG_GUC in the kernel configuration if the debug feature is not required — this eliminates the vulnerable code path entirely. Restricting local system access to trusted users reduces the risk of exploitation until a patched kernel can be deployed (Red Hat Advisory).

Red Hat triaged the issue at low severity and priority, reflecting the limited exploitability due to the debug-only configuration requirement (Red Hat Bugzilla). Ubuntu issued multiple security notices (USN-8094-1 through USN-8094-5) addressing this and related kernel vulnerabilities across supported releases (Ubuntu USN-8094-1). No significant researcher commentary or broader media coverage was observed beyond standard vulnerability tracking and distribution advisories.