- Vulnerability/
- CVE-2025-37868
CVE-2025-37868: drm/xe/userptr: fix notifier vs folio deadlock
First published: Fri May 09 2025(Updated: )
In the Linux kernel, the following vulnerability has been resolved: drm/xe/userptr: fix notifier vs folio deadlock User is reporting what smells like notifier vs folio deadlock, where migrate_pages_batch() on core kernel side is holding folio lock(s) and then interacting with the mappings of it, however those mappings are tied to some userptr, which means calling into the notifier callback and grabbing the notifier lock. With perfect timing it looks possible that the pages we pulled from the hmm fault can get sniped by migrate_pages_batch() at the same time that we are holding the notifier lock to mark the pages as accessed/dirty, but at this point we also want to grab the folio locks(s) to mark them as dirty, but if they are contended from notifier/migrate_pages_batch side then we deadlock since folio lock won't be dropped until we drop the notifier lock. Fortunately the mark_page_accessed/dirty is not really needed in the first place it seems and should have already been done by hmm fault, so just remove it. (cherry picked from commit bd7c0cb695e87c0e43247be8196b4919edbe0e85)
Credit: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Linux kernel |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-37868?
CVE-2025-37868 has a medium severity rating due to the risk of deadlock situations affecting the Linux kernel.
How do I fix CVE-2025-37868?
To fix CVE-2025-37868, you should update to the latest stable version of the Linux kernel that includes the patch for this vulnerability.
What systems are affected by CVE-2025-37868?
CVE-2025-37868 affects various versions of the Linux kernel that utilize the drm/xe/userptr functionality.
What type of vulnerability is CVE-2025-37868?
CVE-2025-37868 is categorized as a deadlock vulnerability in the Linux kernel.
Who is responsible for the CVE-2025-37868 vulnerability?
The CVE-2025-37868 vulnerability was identified in the Linux kernel, which is maintained by the Linux community and various contributors.
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/title
- agent/type
- agent/first-publish-date
- agent/description
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/author
- agent/last-modified-date
- agent/source
- agent/event
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/linux
- canonical/linux kernel