CVE-2025-38356

What it is

In the Linux kernel, the following vulnerability has been resolved: drm/xe/guc: Explicitly exit CT safe mode on unwind During driver probe we might be briefly using CT safe mode, which is based on a delayed work, but usually we are able to stop this once we have IRQ fully operational. However, if we abort the probe quite early then during unwind we might try to destroy the workqueue while there is still a pending delayed work that attempts to restart itself which triggers a WARN. This was recently observed during unsuccessful VF initialization: [ ] xe 0000:00:02.1: probe with driver xe failed with error -62 [ ] ------------[ cut here ]------------ [ ] workqueue: cannot queue safe_mode_worker_func [xe] on wq xe-g2h-wq [ ] WARNING: CPU: 9 PID: 0 at kernel/workqueue.c:2257 __queue_work+0x287/0x710 [ ] RIP: 0010:__queue_work+0x287/0x710 [ ] Call Trace: [ ] delayed_work_timer_fn+0x19/0x30 [ ] call_timer_fn+0xa1/0x2a0 Exit the CT safe mode on unwind to avoid that warning. (cherry picked from commit 2ddbb73ec20b98e70a5200cb85deade22ccea2ec)

At a glance

Exploitability

Can be exploited locally on the machine with a low-privilege account. High risk of service disruption.

Exploit odds

0.2% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2025-07-25 13:15 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-11-05 21:18 UTC Last updatedMost recent change to the record

Why it ranks here

• Exploited in the wild: no, CISA does not list it.
• Exploit odds: 0.2% in the next 30 days (EPSS).
• Severity: 5.5 MEDIUM (CVSS).
• Fix: a patch or advisory is linked.

Details

Published

2025-07-25 13:15 UTC

Last modified

2026-11-05 21:18 UTC

Exploit probability

0.2% · EPSS, next 30 days

Record status

Analyzed

Affected

• Linux Kernel < 6.12.37
• Linux Kernel < 6.15.5
• Linux Kernel 6.16

Attack profile CVSS 3.1 · 5.5

Attack vector

Local

Complexity

Low

Privileges needed

Low

User interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Is it in your code?

Hand this to your coding agent. It searches your project for the affected products and checks versions. Nothing leaves your machine.

Read https://cve-list.com/agent/cve/CVE-2025-38356.md and follow it. Check whether this project is affected by CVE-2025-38356. Read only. Don't change anything and don't upload my code. Tell me yes, no or not sure, with the file as proof.

Copy as ticket · More options · Status badge