UBUNTU-CVE-2025-38353: Medium severity ubuntu/linux-hwe-edge vulnerability

Q: Which systems are exposed to this issue?

The issue applies to Ubuntu systems using one of the listed kernel packages: linux-azure-fde, linux-riscv, linux-realtime, linux-hwe-edge, linux-azure, linux-gcp, linux-gke, or linux-gkeop. The affected code is the Xe DRM driver path.

Q: What conditions are needed to trigger it?

A device must wedge during an early stage such as GuC upload, before submission has been enabled and its state initialized. The faulty wedge handling then attempts to take an invalid lock.

Q: What is the practical impact?

The reported outcome is a kernel locking warning involving xe_guc_submit_wedge. The CVSS vector indicates local access and low privileges are required, with availability impact but no stated confidentiality or integrity impact.

Q: How can I identify signs that a system has encountered the issue?

Kernel logs may show that an Xe device was wedged and needs recovery, followed by a DEBUG_LOCKS_WARN_ON warning from __mutex_lock. The stack trace can include xe_guc_submit_wedge and the xe module.

Published Jul 25, 2025

Updated

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix taking invalid lock on wedge If device wedges on e.g. GuC upload, the submission is not yet enabled and the state is not even initialized. Protect the wedge call so it does nothing in this case. It fixes the following splat: [] xe 0000:bf:00.0: [drm] device wedged, needs recovery [] ------------[ cut here ]------------ [] DEBUGLOCKSWARNON(lock->magic != lock) [] WARNING: CPU: 48 PID: 312 at kernel/locking/mutex.c:564 mutexlock+0x8a1/0xe60 ... [] RIP: 0010:mutexlock+0x8a1/0xe60 [] mutexlocknested+0x1b/0x30 [] xegucsubmitwedge+0x80/0x2b0 [xe]

Affected Software

133 affected componentsFixes available

ubuntu/linux-hwe-edge*

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-azure*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-edge*

ubuntu/linux-oem*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.8*

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-gkeop*

ubuntu/linux-gkeop-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.8*

ubuntu/linux-intel-5.13*

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.8*

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-aws-6.5*

ubuntu/linux-aws-6.8*

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-6.5*

ubuntu/linux-azure-6.8*

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-azure-fde-6.8*

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-gcp-6.5*

ubuntu/linux-gcp-6.8*

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-hwe-6.5*

ubuntu/linux-ibm-6.8*

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-lowlatency-hwe-6.5*

ubuntu/linux-lowlatency-hwe-6.8*

ubuntu/linux-nvidia-6.2*

ubuntu/linux-nvidia-6.5*

ubuntu/linux-nvidia-6.8*

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-oem-6.5*

ubuntu/linux-oracle-6.5*

ubuntu/linux-oracle-6.8*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-riscv-6.5*

ubuntu/linux-riscv-6.8*

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-starfive-6.5*

ubuntu/linux-realtime-6.8*

ubuntu/linux*

ubuntu/linux-aws*

ubuntu/linux-aws-6.14<6.14.0-1015.15~24.04.1

6.14.0-1015.15~24.04.1

ubuntu/linux-azure*

ubuntu/linux-azure-6.11*

ubuntu/linux-azure-6.14<6.14.0-1014.14~24.04.1

6.14.0-1014.14~24.04.1

ubuntu/linux-azure-fde*

ubuntu/linux-azure-fde-6.17*

ubuntu/linux-azure-nvidia*

ubuntu/linux-azure-nvidia-6.14<6.14.0-1007.7

6.14.0-1007.7

ubuntu/linux-gcp*

ubuntu/linux-gcp-6.11*

ubuntu/linux-gcp-6.14<6.14.0-1018.19~24.04.1

6.14.0-1018.19~24.04.1

ubuntu/linux-gke*

ubuntu/linux-gkeop*

ubuntu/linux-hwe-6.11*

ubuntu/linux-ibm*

ubuntu/linux-intel*

ubuntu/linux-lowlatency*

ubuntu/linux-lowlatency-hwe-6.11*

ubuntu/linux-nvidia*

ubuntu/linux-nvidia-6.11*

ubuntu/linux-nvidia-lowlatency*

ubuntu/linux-nvidia-tegra*

ubuntu/linux-oem-6.11*

ubuntu/linux-oem-6.14<6.14.0-1014.14

6.14.0-1014.14

ubuntu/linux-oem-6.8*

ubuntu/linux-oracle*

ubuntu/linux-oracle-6.14<6.14.0-1015.15~24.04.1

6.14.0-1015.15~24.04.1

ubuntu/linux-raspi*

ubuntu/linux-raspi-realtime*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-6.14<6.14.0-34.34.1~24.04.1

6.14.0-34.34.1~24.04.1

ubuntu/linux-vmware*

ubuntu/linux-xilinx*

ubuntu/linux-bluefield*

ubuntu/linux-raspi-realtime*

ubuntu/linux-realtime*

ubuntu/linux-realtime-6.14<6.14.0-1014.14~24.04.1

6.14.0-1014.14~24.04.1

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux-azure-fde*

ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/linux-aws-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-1015.15~24.04.1
Upgrade
Upgrade ubuntu/linux-azure-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-1014.14~24.04.1
Upgrade
Upgrade ubuntu/linux-azure-nvidia-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-1007.7
Upgrade
Upgrade ubuntu/linux-gcp-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-1018.19~24.04.1
Upgrade
Upgrade ubuntu/linux-oem-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-1014.14
Upgrade
Upgrade ubuntu/linux-oracle-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-1015.15~24.04.1
Upgrade
Upgrade ubuntu/linux-riscv-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-34.34.1~24.04.1
Upgrade
Upgrade ubuntu/linux-realtime-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-1014.14~24.04.1

Event History

Jul 25, 2025

CVE Published

via OSV·01:15 PM

Data Sourced

via OSV·01:15 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which systems are exposed to this issue?

The issue applies to Ubuntu systems using one of the listed kernel packages: linux-azure-fde, linux-riscv, linux-realtime, linux-hwe-edge, linux-azure, linux-gcp, linux-gke, or linux-gkeop. The affected code is the Xe DRM driver path.

What conditions are needed to trigger it?

A device must wedge during an early stage such as GuC upload, before submission has been enabled and its state initialized. The faulty wedge handling then attempts to take an invalid lock.

What is the practical impact?

The reported outcome is a kernel locking warning involving xe_guc_submit_wedge. The CVSS vector indicates local access and low privileges are required, with availability impact but no stated confidentiality or integrity impact.

How can I identify signs that a system has encountered the issue?

Kernel logs may show that an Xe device was wedged and needs recovery, followed by a DEBUG_LOCKS_WARN_ON warning from __mutex_lock. The stack trace can include xe_guc_submit_wedge and the xe module.

UBUNTU-CVE-2025-38353: Medium severity ubuntu/linux-hwe-edge vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which systems are exposed to this issue?

What conditions are needed to trigger it?

What is the practical impact?

How can I identify signs that a system has encountered the issue?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this issue?

What conditions are needed to trigger it?

What is the practical impact?

How can I identify signs that a system has encountered the issue?