UBUNTU-CVE-2025-68174: High severity ubuntu/linux-hwe-edge vulnerability

Published Dec 16, 2025
·
Updated

In the Linux kernel, the following vulnerability has been resolved: amd/amdkfd: enhance kfd process check in switch partition current switch partition only check if kfdprocessestable is empty. kfdprcessestable entry is deleted in kfdprocessnotifierrelease, but kfdprocess tear down is in kfdprocesswqrelease. consider two processes: Process A (workqueue) -> kfdprocesswqrelease -> Access kfdnode member Process B switch partition -> amdgpuxcpprepartitionswitch -> amdgpuamdkfddevicefinisw -> kfdnode tear down. Process A and B may trigger a race as shown in dmesg log. This patch is to resolve the race by adding an atomic kfdprocess counter kfdprocessescount, it increment as create kfd process, decrement as finish kfdprocesswqrelease. v2: Put kfdprocessescount per kfddev, move decrement to kfdprocessdestroypdds and bug fix. (Philip Yang) [3966658.307702] divide error: 0000 [#1] SMP NOPTI [3966658.350818] i10nmedac [3966658.356318] CPU: 124 PID: 38435 Comm: kworker/124:0 Kdump: loaded Tainted [3966658.356890] Workqueue: kfdprocesswq kfdprocesswqrelease [amdgpu] [3966658.362839] nfit [3966658.366457] RIP: 0010:kfdgetnumsdmaengines+0x17/0x40 [amdgpu] [3966658.366460] Code: 00 00 e9 ac 81 02 00 66 66 2e 0f 1f 84 00 00 00 00 00 90 0f 1f 44 00 00 48 8b 4f 08 48 8b b7 00 01 00 00 8b 81 58 26 03 00 99 <f7> be b8 01 00 00 80 b9 70 2e 00 00 00 74 0b 83 f8 02 ba 02 00 00 [3966658.380967] x86pkgtempthermal [3966658.391529] RSP: 0018:ffffc900a0edfdd8 EFLAGS: 00010246 [3966658.391531] RAX: 0000000000000008 RBX: ffff8974e593b800 RCX: ffff888645900000 [3966658.391531] RDX: 0000000000000000 RSI: ffff888129154400 RDI: ffff888129151c00 [3966658.391532] RBP: ffff8883ad79d400 R08: 0000000000000000 R09: ffff8890d2750af4 [3966658.391532] R10: 0000000000000018 R11: 0000000000000018 R12: 0000000000000000 [3966658.391533] R13: ffff8883ad79d400 R14: ffffe87ff662ba00 R15: ffff8974e593b800 [3966658.391533] FS: 0000000000000000(0000) GS:ffff88fe7f600000(0000) knlGS:0000000000000000 [3966658.391534] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [3966658.391534] CR2: 0000000000d71000 CR3: 000000dd0e970004 CR4: 0000000002770ee0 [3966658.391535] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [3966658.391535] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400 [3966658.391536] PKRU: 55555554 [3966658.391536] Call Trace: [3966658.391674] deallocatesdmaqueue+0x38/0xa0 [amdgpu] [3966658.391762] processterminationcpsch+0x1ed/0x480 [amdgpu] [3966658.399754] intelpowerclamp [3966658.402831] kfdprocessdequeuefromalldevices+0x5b/0xc0 [amdgpu] [3966658.402908] kfdprocesswqrelease+0x1a/0x1a0 [amdgpu] [3966658.410516] coretemp [3966658.434016] processonework+0x1ad/0x380 [3966658.434021] workerthread+0x49/0x310 [3966658.438963] kvmintel [3966658.446041] ? processonework+0x380/0x380 [3966658.446045] kthread+0x118/0x140 [3966658.446047] ? kthreadbindmask+0x60/0x60 [3966658.446050] retfromfork+0x1f/0x30 [3966658.446053] Modules linked in: kpatch20765354(OEK) [3966658.455310] kvm [3966658.464534] mptcpdiag xskdiag rawdiag unixdiag afpacketdiag netlinkdiag udpdiag actpedit actmirred actvlan clsflower kpatch21951273(OEK) kpatch18424469(OEK) kpatch19749756(OEK) [3966658.473462] idxdmdev [3966658.482306] kpatch17971294(OEK) schingress xtconntrack amdgpu(OE) amdxcp(OE) amddrmbuddy(OE) amdsched(OE) amdttm(OE) amdkcl(OE) intelifs iptablemangle tcmloop targetcorepscsi tcpdiag targetcorefile inetdiag targetcoreiblock targetcoreuser targetcoremod coldpgs kpatch18383292(OEK) ip6tablenat ip6tablefilter ip6tables ipsethashipportip ipsethashipportnet ipsethashipport ipsetbitmapport xtcomment iptablenat nfnat iptablefilter iptables ipset ipvssh ipvswrr ipvsrr ipvs nfconntrack nfdefragipv6 nfdefragipv4 sncoreodd(OE) i40e overlay binfmtmisc tun bonding(OE) aisqos(OE) aisqo ---truncated---

Affected Software

148 affected componentsFixes available
ubuntu/linux-hwe-edge*
ubuntu/linux-aws-5.0*
ubuntu/linux-aws-5.3*
ubuntu/linux-azure*
ubuntu/linux-azure-5.3*
ubuntu/linux-azure-edge*
ubuntu/linux-gcp*
ubuntu/linux-gcp-5.3*
ubuntu/linux-gke-4.15*
ubuntu/linux-gke-5.4*
ubuntu/linux-gkeop-5.4*
ubuntu/linux-hwe*
ubuntu/linux-hwe-edge*
ubuntu/linux-oem*
ubuntu/linux-oracle-5.0*
ubuntu/linux-oracle-5.3*
ubuntu/linux-aws-5.11*
ubuntu/linux-aws-5.13*
ubuntu/linux-aws-5.8*
ubuntu/linux-azure-5.11*
ubuntu/linux-azure-5.13*
ubuntu/linux-azure-5.8*
ubuntu/linux-azure-fde*
ubuntu/linux-gcp-5.11*
ubuntu/linux-gcp-5.13*
ubuntu/linux-gcp-5.8*
ubuntu/linux-gke*
ubuntu/linux-gke-5.15*
ubuntu/linux-gkeop*
ubuntu/linux-gkeop-5.15*
ubuntu/linux-hwe-5.11*
ubuntu/linux-hwe-5.13*
ubuntu/linux-hwe-5.8*
ubuntu/linux-intel-5.13*
ubuntu/linux-oem-5.10*
ubuntu/linux-oem-5.13*
ubuntu/linux-oem-5.6*
ubuntu/linux-oracle-5.11*
ubuntu/linux-oracle-5.13*
ubuntu/linux-oracle-5.8*
ubuntu/linux-raspi2*
ubuntu/linux-riscv*
ubuntu/linux-riscv-5.11*
ubuntu/linux-riscv-5.8*
ubuntu/linux-allwinner-5.19*
ubuntu/linux-aws-5.19*
ubuntu/linux-aws-6.2*
ubuntu/linux-aws-6.5*
ubuntu/linux-aws-6.8*
ubuntu/linux-azure-5.19*
ubuntu/linux-azure-6.2*
ubuntu/linux-azure-6.5*
ubuntu/linux-azure-6.8*
ubuntu/linux-azure-fde-5.19*
ubuntu/linux-azure-fde-6.2*
ubuntu/linux-azure-fde-6.8*
ubuntu/linux-gcp-5.19*
ubuntu/linux-gcp-6.2*
ubuntu/linux-gcp-6.5*
ubuntu/linux-gcp-6.8*
ubuntu/linux-hwe-5.19*
ubuntu/linux-hwe-6.2*
ubuntu/linux-hwe-6.5*
ubuntu/linux-ibm-6.8*
ubuntu/linux-intel-iot-realtime*
ubuntu/linux-lowlatency-hwe-5.19*
ubuntu/linux-lowlatency-hwe-6.2*
ubuntu/linux-lowlatency-hwe-6.5*
ubuntu/linux-lowlatency-hwe-6.8*
ubuntu/linux-nvidia-6.2*
ubuntu/linux-nvidia-6.5*
ubuntu/linux-nvidia-6.8*
ubuntu/linux-oem-5.17*
ubuntu/linux-oem-6.0*
ubuntu/linux-oem-6.1*
ubuntu/linux-oem-6.5*
ubuntu/linux-oracle-6.5*
ubuntu/linux-oracle-6.8*
ubuntu/linux-realtime*
ubuntu/linux-riscv*
ubuntu/linux-riscv-5.19*
ubuntu/linux-riscv-6.5*
ubuntu/linux-riscv-6.8*
ubuntu/linux-starfive-5.19*
ubuntu/linux-starfive-6.2*
ubuntu/linux-starfive-6.5*
ubuntu/linux-realtime-6.8*
ubuntu/linux*
ubuntu/linux-aws*
ubuntu/linux-aws-6.14*
ubuntu/linux-aws-6.17<6.17.0-1007.7~24.04.1
6.17.0-1007.7~24.04.1
ubuntu/linux-azure*
ubuntu/linux-azure-6.11*
ubuntu/linux-azure-6.14*
ubuntu/linux-azure-fde*
ubuntu/linux-azure-fde-6.14*
ubuntu/linux-azure-fde-6.17*
ubuntu/linux-azure-nvidia*
ubuntu/linux-azure-nvidia-6.14*
ubuntu/linux-gcp*
ubuntu/linux-gcp-6.11*
ubuntu/linux-gcp-6.14*
ubuntu/linux-gcp-6.17<6.17.0-1008.8~24.04.1
6.17.0-1008.8~24.04.1
ubuntu/linux-gke*
ubuntu/linux-gkeop*
ubuntu/linux-hwe-6.11*
ubuntu/linux-hwe-6.14*
ubuntu/linux-ibm*
ubuntu/linux-lowlatency*
ubuntu/linux-lowlatency-hwe-6.11*
ubuntu/linux-nvidia*
ubuntu/linux-nvidia-6.11*
ubuntu/linux-nvidia-6.17<6.17.0-1008.8
6.17.0-1008.8
ubuntu/linux-nvidia-lowlatency*
ubuntu/linux-nvidia-tegra<6.8.0-1035.38
6.8.0-1035.38
ubuntu/linux-oem-6.11*
ubuntu/linux-oem-6.14*
ubuntu/linux-oem-6.17<6.17.0-1011.11
6.17.0-1011.11
ubuntu/linux-oem-6.8*
ubuntu/linux-oracle*
ubuntu/linux-oracle-6.14*
ubuntu/linux-oracle-6.17<6.17.0-1007.7~24.04.1
6.17.0-1007.7~24.04.1
ubuntu/linux-raspi*
ubuntu/linux-raspi-realtime*
ubuntu/linux-realtime*
ubuntu/linux-riscv*
ubuntu/linux-riscv-6.14*
ubuntu/linux-vmware*
ubuntu/linux-xilinx*
ubuntu/linux-bluefield*
ubuntu/linux-raspi-realtime*
ubuntu/linux-realtime*
ubuntu/linux-realtime-6.14*
ubuntu/linux-realtime-6.17<6.17.0-1006.7~24.04.1
6.17.0-1006.7~24.04.1
ubuntu/linux-aws-fips*
ubuntu/linux-azure-fips*
ubuntu/linux-fips*
ubuntu/linux-gcp-fips*
ubuntu/linux<6.17.0-14.14
6.17.0-14.14
ubuntu/linux-aws<6.17.0-1007.7
6.17.0-1007.7
ubuntu/linux-azure<6.17.0-1008.8
6.17.0-1008.8
ubuntu/linux-azure-fde*
ubuntu/linux-gcp<6.17.0-1007.7
6.17.0-1007.7
ubuntu/linux-oracle<6.17.0-1007.7
6.17.0-1007.7
ubuntu/linux-raspi<6.17.0-1008.8
6.17.0-1008.8
ubuntu/linux-realtime<6.17.0-1006.7
6.17.0-1006.7
ubuntu/linux-riscv<6.17.0-14.14.1
6.17.0-14.14.1
ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade ubuntu/linux-aws-6.17 to a version that resolves this vulnerability.

    Fixed in 6.17.0-1007.7~24.04.1
  2. Upgrade

    Upgrade ubuntu/linux-gcp-6.17 to a version that resolves this vulnerability.

    Fixed in 6.17.0-1008.8~24.04.1
  3. Upgrade

    Upgrade ubuntu/linux-nvidia-6.17 to a version that resolves this vulnerability.

    Fixed in 6.17.0-1008.8
  4. Upgrade

    Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.

    Fixed in 6.8.0-1035.38
  5. Upgrade

    Upgrade ubuntu/linux-oem-6.17 to a version that resolves this vulnerability.

    Fixed in 6.17.0-1011.11
  6. Upgrade

    Upgrade ubuntu/linux-oracle-6.17 to a version that resolves this vulnerability.

    Fixed in 6.17.0-1007.7~24.04.1
  7. Upgrade

    Upgrade ubuntu/linux-realtime-6.17 to a version that resolves this vulnerability.

    Fixed in 6.17.0-1006.7~24.04.1
  8. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 6.17.0-14.14
  9. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 6.17.0-1007.7
  10. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 6.17.0-1008.8
  11. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 6.17.0-1007.7
  12. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 6.17.0-1007.7
  13. Upgrade

    Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.

    Fixed in 6.17.0-1008.8
  14. Upgrade

    Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.

    Fixed in 6.17.0-1006.7
  15. Upgrade

    Upgrade ubuntu/linux-riscv to a version that resolves this vulnerability.

    Fixed in 6.17.0-14.14.1

Event History

Dec 16, 2025
CVE Published
via OSV·02:15 PM
Data Sourced
via OSV·02:15 PM
DescriptionSeverityAffected Software

Frequently Asked Questions

1

Who is exposed to this issue?

Systems using the listed Ubuntu kernel packages may be exposed when AMD KFD/AMDGPU functionality is in use and GPU partition switching can occur. The race involves a KFD process teardown occurring concurrently with an AMDGPU partition switch.

2

What access does an attacker need?

The severity vector indicates local access with low privileges is required, and no user interaction is needed. Exploitation depends on triggering the relevant KFD process and partition-switch race.

3

What evidence may indicate this race has occurred?

The provided crash log shows a divide error in kfd_get_num_sdma_engines from the kfd_process_wq_release workqueue handler in the amdgpu module. Logs may also show a kworker process and the kfd_process_wq workqueue near the failure.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203