CVE-2025-38353 drm/xe: Fix taking invalid lock on wedge
A race condition in the Linux kernel's Xe GPU driver causes a kernel warning and potential denial of service when a device wedges before submission is enabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-38353?
CVE-2025-38353 is a medium-severity vulnerability in Linux kernel, published on 25 Jul 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
drm/xe: Fix taking invalid lock on wedge
If device wedges on e.g. GuC upload, the submission is not yet enabled and the state is not even initialized. Protect the wedge call so it does nothing in this case. It fixes the following splat:
[] xe 0000:bf:00.0: [drm] device wedged, needs recovery [] ------------[ cut here ]------------ [] DEBUG_LOCKS_WARN_ON(lock->magic != lock) [] WARNING: CPU: 48 PID: 312 at kernel/locking/mutex.c:564 __mutex_lock+0x8a1/0xe60 ... [] RIP: 0010:__mutex_lock+0x8a1/0xe60 [] mutex_lock_nested+0x1b/0x30 [] xe_guc_submit_wedge+0x80/0x2b0 [xe]
Weakness: CWE-667
Which versions are affected by CVE-2025-38353?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-38353?
Apply the vendor's patch.
Is CVE-2025-38353 being exploited?
There is no known exploitation of CVE-2025-38353 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2025-38353, DEBIAN-CVE-2025-38353, GHSA-7q3f-xf6v-wv4w, ROOT-OS-UBUNTU-2204-CVE-2025-38353, ROOT-OS-UBUNTU-2404-CVE-2025-38353, UBUNTU-CVE-2025-38353.