CVE-2025-38036: drm/xe/vf: Perform early GT MMIO initialization to read GMDID
In the Linux kernel, the following vulnerability has been resolved:
drm/xe/vf: Perform early GT MMIO initialization to read GMDID
VFs need to communicate with the GuC to obtain the GMDID value and existing GuC functions used for that assume that the GT has it's MMIO members already setup. However, due to recent refactoring the gt->mmio is initialized later, and any attempt by the VF to use xemmioread|write() from GuC functions will lead to NPD crash due to unset MMIO register address:
[] xe 0000:00:02.1: [drm] Running in SR-IOV VF mode [] xe 0000:00:02.1: [drm] GT0: sending H2G MMIO 0x5507 [] BUG: unable to handle page fault for address: 0000000000190240
Since we are already tweaking the id and type of the primary GT to mimic it's a Media GT before initializing the GuC communication, we can also call xegtmmioinit() to perform early setup of the gt->mmio which will make those GuC functions work again.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1013.13~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-nvidia-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1007.7 - Upgrade
Upgrade
ubuntu/linux-gcp-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1016.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-oem-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1012.12 - Upgrade
Upgrade
ubuntu/linux-oracle-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1013.13~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-32.32.1~24.04.1 - Upgrade
Upgrade
ubuntu/linux-realtime-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1012.12~24.04.1
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel xe driver in SR-IOV virtual function (VF) mode are affected by the initialization failure described. The failure occurs when the VF communicates with the GuC before GT MMIO state has been initialized.
What level of access is required to trigger the impact?
The CVSS vector indicates local access with low privileges and no user interaction is required. The reported impact is a kernel page fault that can cause a denial of service.
How can I tell whether a system has encountered this problem?
Kernel logs may show that xe is running in SR-IOV VF mode, followed by a GT0 H2G MMIO message and a page-fault error for address 0000000000190240. The log can include "BUG: unable to handle page fault" after the GuC MMIO operation.
What should be done if this affects a system?
Apply the available Linux kernel patch. The fix initializes GT MMIO earlier so the GuC functions used to obtain GMDID do not access an unset MMIO register address.