{"id":"DEBIAN-CVE-2025-68757","details":"In the Linux kernel, the following vulnerability has been resolved:  drm/vgem-fence: Fix potential deadlock on release  A timer that expires a vgem fence automatically in 10 seconds is now released with timer_delete_sync() from fence-\u003eops.release() called on last dma_fence_put().  In some scenarios, it can run in IRQ context, which is not safe unless TIMER_IRQSAFE is used.  One potentially risky scenario was demonstrated in Intel DRM CI trybot, BAT run on machine bat-adlp-6, while working on new IGT subtests syncobj_timeline@stress-* as user space replacements of some problematic test cases of a dma-fence-chain selftest [1].  [117.004338] ================================ [117.004340] WARNING: inconsistent lock state [117.004342] 6.17.0-rc7-CI_DRM_17270-g7644974e648c+ #1 Tainted: G S   U [117.004346] -------------------------------- [117.004347] inconsistent {HARDIRQ-ON-W} -\u003e {IN-HARDIRQ-W} usage. [117.004349] swapper/0/0 [HC1[1]:SC1[1]:HE0:SE0] takes: [117.004352] ffff888138f86aa8 ((&fence-\u003etimer)){?.-.}-{0:0}, at: __timer_delete_sync+0x4b/0x190 [117.004361] {HARDIRQ-ON-W} state was registered at: [117.004363]   lock_acquire+0xc4/0x2e0 [117.004366]   call_timer_fn+0x80/0x2a0 [117.004368]   __run_timers+0x231/0x310 [117.004370]   run_timer_softirq+0x76/0xe0 [117.004372]   handle_softirqs+0xd4/0x4d0 [117.004375]   __irq_exit_rcu+0x13f/0x160 [117.004377]   irq_exit_rcu+0xe/0x20 [117.004379]   sysvec_apic_timer_interrupt+0xa0/0xc0 [117.004382]   asm_sysvec_apic_timer_interrupt+0x1b/0x20 [117.004385]   cpuidle_enter_state+0x12b/0x8a0 [117.004388]   cpuidle_enter+0x2e/0x50 [117.004393]   call_cpuidle+0x22/0x60 [117.004395]   do_idle+0x1fd/0x260 [117.004398]   cpu_startup_entry+0x29/0x30 [117.004401]   start_secondary+0x12d/0x160 [117.004404]   common_startup_64+0x13e/0x141 [117.004407] irq event stamp: 2282669 [117.004409] hardirqs last  enabled at (2282668): [\u003cffffffff8289db71\u003e] _raw_spin_unlock_irqrestore+0x51/0x80 [117.004414] hardirqs last disabled at (2282669): [\u003cffffffff82882021\u003e] sysvec_irq_work+0x11/0xc0 [117.004419] softirqs last  enabled at (2254702): [\u003cffffffff8289fd00\u003e] __do_softirq+0x10/0x18 [117.004423] softirqs last disabled at (2254725): [\u003cffffffff813d4ddf\u003e] __irq_exit_rcu+0x13f/0x160 [117.004426] other info that might help us debug this: [117.004429]  Possible unsafe locking scenario: [117.004432]        CPU0 [117.004433]        ---- [117.004434]   lock((&fence-\u003etimer)); [117.004436]   \u003cInterrupt\u003e [117.004438]     lock((&fence-\u003etimer)); [117.004440]  *** DEADLOCK *** [117.004443] 1 lock held by swapper/0/0: [117.004445]  #0: ffffc90000003d50 ((&fence-\u003etimer)){?.-.}-{0:0}, at: call_timer_fn+0x7a/0x2a0 [117.004450] stack backtrace: [117.004453] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G S   U              6.17.0-rc7-CI_DRM_17270-g7644974e648c+ #1 PREEMPT(voluntary) [117.004455] Tainted: [S]=CPU_OUT_OF_SPEC, [U]=USER [117.004455] Hardware name: Intel Corporation Alder Lake Client Platform/AlderLake-P DDR4 RVP, BIOS RPLPFWI1.R00.4035.A00.2301200723 01/20/2023 [117.004456] Call Trace: [117.004456]  \u003cIRQ\u003e [117.004457]  dump_stack_lvl+0x91/0xf0 [117.004460]  dump_stack+0x10/0x20 [117.004461]  print_usage_bug.part.0+0x260/0x360 [117.004463]  mark_lock+0x76e/0x9c0 [117.004465]  ? register_lock_class+0x48/0x4a0 [117.004467]  __lock_acquire+0xbc3/0x2860 [117.004469]  lock_acquire+0xc4/0x2e0 [117.004470]  ? __timer_delete_sync+0x4b/0x190 [117.004472]  ? __timer_delete_sync+0x4b/0x190 [117.004473]  __timer_delete_sync+0x68/0x190 [117.004474]  ? __timer_delete_sync+0x4b/0x190 [117.004475]  timer_delete_sync+0x10/0x20 [117.004476]  vgem_fence_release+0x19/0x30 [vgem] [117.004478]  dma_fence_release+0xc1/0x3b0 [117.004480]  ? dma_fence_release+0xa1/0x3b0 [117.004481]  dma_fence_chain_release+0xe7/0x130 [117.004483]  dma_fence_release+0xc1/0x3b0 [117.004484]  ? _raw_spin_unlock_irqrestore+0x27/0x80 [117.004485]  dma_fence_chain_irq_work+0x59/0x80 [117.004487]  irq_work_single+0x75/0xa0 [117.004490]  irq_work_r ---truncated---","modified":"2026-09-01T16:06:21.752502721Z","published":"2026-01-05T10:15:56.773Z","upstream":["CVE-2025-68757"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2025-68757"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.162-1"}]}],"versions":["6.1.106-1","6.1.106-2","6.1.106-3","6.1.112-1","6.1.115-1","6.1.119-1","6.1.123-1","6.1.124-1","6.1.128-1","6.1.129-1","6.1.133-1","6.1.135-1","6.1.137-1","6.1.139-1","6.1.140-1","6.1.147-1","6.1.148-1","6.1.153-1","6.1.158-1","6.1.159-1","6.1.27-1","6.1.37-1","6.1.38-1","6.1.38-2","6.1.38-2~bpo11+1","6.1.38-3","6.1.38-4","6.1.38-4~bpo11+1","6.1.52-1","6.1.55-1","6.1.55-1~bpo11+1","6.1.64-1","6.1.66-1","6.1.67-1","6.1.69-1","6.1.69-1~bpo11+1","6.1.76-1","6.1.76-1~bpo11+1","6.1.82-1","6.1.85-1","6.1.90-1","6.1.90-1~bpo11+1","6.1.94-1","6.1.94-1~bpo11+1","6.1.98-1","6.1.99-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-68757.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.63-1"}]}],"versions":["6.12.38-1","6.12.41-1","6.12.43-1","6.12.43-1~bpo12+1","6.12.48-1","6.12.57-1","6.12.57-1~bpo12+1","6.12.63-1~bpo12+1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-68757.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.13-1"}]}],"versions":["6.12.100-1","6.12.101-1","6.12.105-1","6.12.107-1","6.12.38-1","6.12.41-1","6.12.43-1","6.12.43-1~bpo12+1","6.12.48-1","6.12.57-1","6.12.57-1~bpo12+1","6.12.63-1","6.12.63-1~bpo12+1","6.12.69-1","6.12.69-1~bpo12+1","6.12.73-1","6.12.73-1~bpo12+1","6.12.74-1","6.12.74-2","6.12.74-2~bpo12+1","6.12.85-1","6.12.85-1~bpo12+1","6.12.86-1","6.12.86-1~bpo12+1","6.12.88-1","6.12.88-1~bpo12+1","6.12.90-1","6.12.90-1~bpo12+1","6.12.90-2","6.12.90-2~bpo12+1","6.12.94-1","6.12.94-1~bpo12+1","6.12.95-1","6.12.95-1~bpo12+1","6.12.96-1","6.13.10-1~exp1","6.13.11-1~exp1","6.13.2-1~exp1","6.13.3-1~exp1","6.13.4-1~exp1","6.13.5-1~exp1","6.13.6-1~exp1","6.13.7-1~exp1","6.13.8-1~exp1","6.13.9-1~exp1","6.13~rc6-1~exp1","6.13~rc7-1~exp1","6.14.3-1~exp1","6.14.5-1~exp1","6.14.6-1~exp1","6.15-1~exp1","6.15.1-1~exp1","6.15.2-1~exp1","6.15.3-1~exp1","6.15.4-1~exp1","6.15.5-1~exp1","6.15.6-1~exp1","6.15~rc7-1~exp1","6.16-1~exp1","6.16.1-1~exp1","6.16.10-1","6.16.11-1","6.16.12-1","6.16.12-1~bpo13+1","6.16.12-2","6.16.3-1","6.16.3-1~bpo13+1","6.16.5-1","6.16.6-1","6.16.7-1","6.16.8-1","6.16.9-1","6.16~rc7-1~exp1","6.17.10-1","6.17.11-1","6.17.12-1","6.17.13-1~bpo13+1","6.17.2-1~exp1","6.17.5-1~exp1","6.17.6-1","6.17.7-1","6.17.7-2","6.17.8-1","6.17.8-1~bpo13+1","6.17.9-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-68757.json"}}],"schema_version":"1.9.0"}