Executive brief
A vulnerability was identified in the Linux kernel's graphics driver for Qualcomm Adreno GPUs (MSM). This issue occurs when the system handles video playback or graphics memory, potentially leading to a system crash or instability. An attacker with local access could exploit this to disrupt operations or gain unauthorized access to system resources.
Technical details
A vulnerability exists in the msm_gem_free_object function within drivers/gpu/drm/msm/msm_gem.c of the Linux kernel. The root cause is an incorrect check during the freeing of imported dma-bufs, where the code failed to properly validate the MSM_BO_NO_SHARE flag alongside the reservation object state. This can lead to a reference count underflow (splat) during error paths or specific video playback scenarios (e.g., IRIS video playback). A local attacker can trigger this via IOCTL calls to the DRM subsystem, potentially leading to a denial of service (kernel panic) or privilege escalation. The issue has been patched in stable branches by ensuring both the NO_SHARE flag and reservation object conditions are checked before dropping references.
Affected products
- Linux Linux Kernel 6.17 to 6.17.8, 6.18
Timeline
- 2025-12-16: advisory: CVE-2025-68189 published by kernel.org
- 2025-11-13: patched: Fix committed to stable kernel tree