Executive brief
A security vulnerability has been identified in the Linux kernel's Panthor DRM driver, which manages graphics memory for certain hardware. The flaw involves a 'use-after-free' condition where the system attempts to access memory that has already been released, specifically within the debug interface (debugfs). If exploited, a local user could potentially cause a system crash or gain unauthorized access to sensitive information.
Technical details
A use-after-free (UAF) vulnerability exists in the Linux kernel Panthor DRM driver within `drivers/gpu/drm/panthor/panthor_gem.c`. The root cause is an improper ordering of object lifecycle management where `drm_gem_object_put()` could be called before debugfs tracking was fully processed, leading to a race condition or access to a freed object. The vulnerability is triggered via the `panthor_gem_create_with_handle()` function when debugfs is enabled. A local attacker with low privileges can exploit this to cause memory corruption or kernel execution. The fix involves reordering the initialization sequence to ensure objects are fully constructed and added to debugfs before handles are created and references are dropped. Patches have been released for the Linux kernel stable tree.
Affected products
- Linux Linux Kernel 6.16, 6.16.1, 6.17
Timeline
- 2025-08-19: disclosed
- 2025-08-19: advisory
- 2025-08-15: patched