Executive brief
A vulnerability in the Linux kernel's Panthor graphics driver could allow local users to access sensitive information or cause system instability. The issue occurs when the system fails to properly clear memory before it is used by the graphics processor. This could lead to data leaks from previously used memory or corruption of active data buffers.
Technical details
A vulnerability exists in the panthor_gem.c component of the Linux kernel's Panthor DRM driver. The shmem layer zeroes out new pages using cached mappings; however, if a CPU cache flush is not performed before mapping these buffers as CPU-uncached (write-combine), dirty cachelines may remain. This race condition allows for potential data leaks of stale memory contents or asynchronous buffer corruption when dirty cachelines are eventually evicted to memory. The fix involves forcing a CPU cache flush by querying the scatter-gather table (sgt) during buffer object creation when write-combine mapping is used. This is a local vulnerability requiring low privileges.
Affected products
- Linux Linux Kernel 6.10 to 6.12.64, 6.17.9, 6.18
Timeline
- 2025-12-06: advisory: Initial NVD publication date
- 2025-11-07: patched: Original patch authored by Boris Brezillon