CVE-2026-68382

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/xe/guc: Hold device ref until queue teardown completes<br /> <br /> GuC exec queue destruction can run asynchronously. If the final device<br /> put happens from a destroy worker, drmm cleanup can end up draining<br /> the same workqueue and deadlock.<br /> <br /> Hold a drm_device reference for the queue lifetime and drop it after<br /> queue teardown completes. This keeps drmm cleanup from running while<br /> async destroy work is still pending.<br /> <br /> Move GuC destroy work to a module-lifetime Xe workqueue and flush it<br /> on PCI remove so hot-unbind/rebind still waits for pending destroy work.<br /> <br /> With queue-held device refs, guc_submit_sw_fini() cannot run with live<br /> GuC IDs. Replace the fini wait with an assertion and remove the unused<br /> fini_wq.<br /> <br /> v2:<br /> - Rebase<br /> <br /> v3:<br /> - Switch to queue-lifetime drm_dev_get()/drm_dev_put() model. (Matt)<br /> - Queue async teardown on system_dfl_wq instead of xe-&gt;destroy_wq. (Matt)<br /> - Drop separate deferred drm_dev_put worker.<br /> - Remove stale drain_workqueue(xe-&gt;destroy_wq) from guc_submit_sw_fini().<br /> <br /> v4:<br /> - Replace the guc_submit_sw_fini() wait with an assertion and remove<br /> the now-unused fini_wq. (sashiko)<br /> <br /> v5:<br /> - Move destroy work to a module-lifetime Xe workqueue instead of<br /> system_dfl_wq. (Matt)<br /> - Flush the module-lifetime destroy workqueue during PCI remove to<br /> preserve the old device-remove wait semantics.<br /> <br /> v6:<br /> - Keep SVM pagemap destroy work on the per-device destroy_wq to avoid<br /> letting it outlive the xe_device/drm_device. (Sashiko)<br /> - Use WQ_MEM_RECLAIM for xe-&gt;destroy_wq because SVM pagemap destroy work<br /> can be queued from the reclaim path.<br /> <br /> v7:<br /> - Drop the per-device xe-&gt;destroy_wq and use the module-level destroy WQ<br /> for SVM pagemap destroy as well. (Matt)<br /> - Rename xe_exec_queue_destroy_wq_*() helpers to xe_destroy_wq_*()<br /> helpers because the WQ is no longer exec-queue specific. (Matt)<br /> <br /> v8:<br /> - Rebase.<br /> <br /> v9:<br /> - Keep SVM pagemap destroy work on the per-device WQ_MEM_RECLAIM<br /> destroy_wq because it can be queued from reclaim and embeds<br /> the dev_pagemap used by devres teardown. (Sashiko)<br /> - Keep the module-level destroy WQ GuC-only and drop WQ_MEM_RECLAIM<br /> from it.<br /> - Update the module-WQ kdoc to document the GuC/SVM split.<br /> <br /> v10:<br /> - Keep xe-&gt;destroy_wq per-cpu while adding WQ_MEM_RECLAIM to fix the<br /> workqueue allocation warning.<br /> <br /> v11:<br /> - Drop the SVM pagemap destroy comment as it was revision-specific.<br /> (Thomas)<br /> <br /> v12:<br /> - Rebase.<br /> <br /> (cherry picked from commit da1124abac689cc2b1d8995e5f0a816f8a122edb)