Executive brief
A vulnerability exists in the Linux kernel's Panthor graphics driver, which is used to manage modern ARM Mali GPUs. Under certain conditions where the graphics memory management unit (MMU) is unresponsive, the system may fail to properly clean up internal memory records. This can lead to a 'use-after-free' scenario, potentially allowing a local attacker to crash the system or gain unauthorized access to sensitive data.
Technical details
A use-after-free (UAF) vulnerability exists in the Panthor DRM driver (drivers/gpu/drm/panthor/panthor_gem.c) within the Linux kernel. The issue stems from the 'panthor_kernel_bo_destroy' function, which would prematurely bail out if 'panthor_vm_unmap_range' returned an error (e.g., if the MMU was down). This left the 'va_node' inserted in the 'drm_mm' range manager despite the underlying object being freed. Subsequent removal of adjacent nodes in the 'drm_mm' tree would then trigger a UAF. The fix ensures that cleanup and VA node freeing proceed regardless of the unmap return status. This is reachable by a local user with access to the GPU device.
Affected products
- Linux Linux Kernel 6.10 to 6.18.2
Timeline
- 2025-10-31: patched: Initial fix authored by Boris Brezillon
- 2025-12-24: advisory: CVE-2025-68747 published by kernel.org