CVE-2025-68757
BaseFortify
Publication date: 2026-01-05
Last updated on: 2026-01-19
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| intel | linux_kernel | 6.17.0-rc7-ci_drm_17270-g7644974e648c |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a potential deadlock issue in the Linux kernel's drm/vgem-fence component. It involves a timer that expires a vgem fence automatically after 10 seconds. The timer is released using timer_delete_sync() from fence->ops.release() when the last dma_fence_put() is called. However, in some scenarios, this release can run in IRQ context, which is unsafe unless TIMER_IRQSAFE is used. This unsafe locking scenario can lead to a deadlock, as demonstrated in testing on Intel hardware with specific DRM tests.
How can this vulnerability impact me? :
This vulnerability can cause a deadlock in the Linux kernel when the drm/vgem-fence timer is released in an unsafe IRQ context. A deadlock can halt or severely disrupt system operations, potentially causing system instability or crashes, especially in environments using the affected DRM components and related fence synchronization mechanisms.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring kernel logs for warnings related to inconsistent lock states and potential deadlocks involving vgem fence timers. Specifically, look for messages similar to 'WARNING: inconsistent lock state' and 'DEADLOCK' in dmesg or /var/log/kern.log. You can use commands like 'dmesg | grep -i vgem' or 'journalctl -k | grep -i fence' to find relevant log entries indicating the issue.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves updating the Linux kernel to a version where the vulnerability is fixed, as the issue is resolved by properly releasing the vgem fence timer with timer_delete_sync() in fence->ops.release(). Until the update is applied, avoid running workloads or tests that trigger the problematic dma-fence-chain scenarios, such as the IGT subtests syncobj_timeline@stress-*, to reduce the risk of deadlocks.