GHSA-P8F8-3JM7-5JM4
Vulnerability from github – Published: 2025-12-16 15:30 – Updated: 2025-12-16 15:30In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: fix lock warning in amdgpu_userq_fence_driver_process
Fix a potential deadlock caused by inconsistent spinlock usage between interrupt and process contexts in the userq fence driver.
The issue occurs when amdgpu_userq_fence_driver_process() is called from both: - Interrupt context: gfx_v11_0_eop_irq() -> amdgpu_userq_fence_driver_process() - Process context: amdgpu_eviction_fence_suspend_worker() -> amdgpu_userq_fence_driver_force_completion() -> amdgpu_userq_fence_driver_process()
In interrupt context, the spinlock was acquired without disabling interrupts, leaving it in {IN-HARDIRQ-W} state. When the same lock is acquired in process context, the kernel detects inconsistent locking since the process context acquisition would enable interrupts while holding a lock previously acquired in interrupt context.
Kernel log shows: [ 4039.310790] inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage. [ 4039.310804] kworker/7:2/409 [HC0[0]:SC0[0]:HE1:SE1] takes: [ 4039.310818] ffff9284e1bed000 (&fence_drv->fence_list_lock){?...}-{3:3}, [ 4039.310993] {IN-HARDIRQ-W} state was registered at: [ 4039.311004] lock_acquire+0xc6/0x300 [ 4039.311018] _raw_spin_lock+0x39/0x80 [ 4039.311031] amdgpu_userq_fence_driver_process.part.0+0x30/0x180 [amdgpu] [ 4039.311146] amdgpu_userq_fence_driver_process+0x17/0x30 [amdgpu] [ 4039.311257] gfx_v11_0_eop_irq+0x132/0x170 [amdgpu]
Fix by using spin_lock_irqsave()/spin_unlock_irqrestore() to properly manage interrupt state regardless of calling context.
(cherry picked from commit ded3ad780cf97a04927773c4600823b84f7f3cc2)
{
"affected": [],
"aliases": [
"CVE-2025-68203"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-16T14:15:53Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix lock warning in amdgpu_userq_fence_driver_process\n\nFix a potential deadlock caused by inconsistent spinlock usage\nbetween interrupt and process contexts in the userq fence driver.\n\nThe issue occurs when amdgpu_userq_fence_driver_process() is called\nfrom both:\n- Interrupt context: gfx_v11_0_eop_irq() -\u003e amdgpu_userq_fence_driver_process()\n- Process context: amdgpu_eviction_fence_suspend_worker() -\u003e\n amdgpu_userq_fence_driver_force_completion() -\u003e amdgpu_userq_fence_driver_process()\n\nIn interrupt context, the spinlock was acquired without disabling\ninterrupts, leaving it in {IN-HARDIRQ-W} state. When the same lock\nis acquired in process context, the kernel detects inconsistent\nlocking since the process context acquisition would enable interrupts\nwhile holding a lock previously acquired in interrupt context.\n\nKernel log shows:\n[ 4039.310790] inconsistent {IN-HARDIRQ-W} -\u003e {HARDIRQ-ON-W} usage.\n[ 4039.310804] kworker/7:2/409 [HC0[0]:SC0[0]:HE1:SE1] takes:\n[ 4039.310818] ffff9284e1bed000 (\u0026fence_drv-\u003efence_list_lock){?...}-{3:3},\n[ 4039.310993] {IN-HARDIRQ-W} state was registered at:\n[ 4039.311004] lock_acquire+0xc6/0x300\n[ 4039.311018] _raw_spin_lock+0x39/0x80\n[ 4039.311031] amdgpu_userq_fence_driver_process.part.0+0x30/0x180 [amdgpu]\n[ 4039.311146] amdgpu_userq_fence_driver_process+0x17/0x30 [amdgpu]\n[ 4039.311257] gfx_v11_0_eop_irq+0x132/0x170 [amdgpu]\n\nFix by using spin_lock_irqsave()/spin_unlock_irqrestore() to properly\nmanage interrupt state regardless of calling context.\n\n(cherry picked from commit ded3ad780cf97a04927773c4600823b84f7f3cc2)",
"id": "GHSA-p8f8-3jm7-5jm4",
"modified": "2025-12-16T15:30:45Z",
"published": "2025-12-16T15:30:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68203"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/1ad70a06d7e91c378b346a3718c81abb50a74b74"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/6623c5f9fd877868fba133b4ae4dab0052e82dad"
}
],
"schema_version": "1.4.0",
"severity": []
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.