Executive brief
A vulnerability exists in the Linux kernel's Panthor DRM driver, which manages certain graphics hardware. When a device is unplugged, the system may attempt to access memory that has already been cleared, leading to a system crash or potential unauthorized access. This could allow a local user with basic access to compromise the stability or security of the operating system.
Technical details
A use-after-free (UAF) race condition exists in the drm/panthor driver between device unplugging and firmware event processing. The function panthor_fw_unplug() frees firmware memory sections while process_fw_events_work() may still be queued to access that same memory. An attacker with local access could exploit this race condition to trigger a kernel panic or achieve privilege escalation. The fix involves calling disable_work_sync() to ensure all pending firmware events are drained and future invocations are prevented before memory is freed. Patches have been merged into various stable branches including 6.12.x and 6.18.x.
Affected products
- Linux Linux Kernel 6.10 to 6.12.63, 6.17.13, 6.18.2
Timeline
- 2025-12-24: advisory: Initial disclosure of CVE-2025-68748
- 2025-12-18: patched: Fix committed to stable kernel trees