Bug 2373359 (CVE-2025-38036) - CVE-2025-38036 kernel: drm/xe/vf: Perform early GT MMIO initialization to read GMDID
Summary: CVE-2025-38036 kernel: drm/xe/vf: Perform early GT MMIO initialization to rea...
Keywords:
Status: NEW
Alias: CVE-2025-38036
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-06-18 10:03 UTC by OSIDB Bzimport
Modified: 2025-06-21 12:46 UTC (History)
4 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2025-06-18 10:03:26 UTC
In the Linux kernel, the following vulnerability has been resolved:

drm/xe/vf: Perform early GT MMIO initialization to read GMDID

VFs need to communicate with the GuC to obtain the GMDID value
and existing GuC functions used for that assume that the GT has
it's MMIO members already setup. However, due to recent refactoring
the gt->mmio is initialized later, and any attempt by the VF to use
xe_mmio_read|write() from GuC functions will lead to NPD crash due
to unset MMIO register address:

[] xe 0000:00:02.1: [drm] Running in SR-IOV VF mode
[] xe 0000:00:02.1: [drm] GT0: sending H2G MMIO 0x5507
[] BUG: unable to handle page fault for address: 0000000000190240

Since we are already tweaking the id and type of the primary GT to
mimic it's a Media GT before initializing the GuC communication,
we can also call xe_gt_mmio_init() to perform early setup of the
gt->mmio which will make those GuC functions work again.

Comment 1 Avinash Hanwate 2025-06-20 18:40:30 UTC
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025061826-CVE-2025-38036-0063@gregkh/T


Note You need to log in before you can comment on or make changes to this bug.