Executive brief
A vulnerability was identified in the Linux kernel's Panthor DRM driver, which manages graphics processing for certain hardware. A race condition in how the system handles memory cleanup could allow a local user to cause a system crash or potentially gain unauthorized access to data. This issue affects the stability and security of systems using specific ARM-based graphics hardware.
Technical details
A race condition exists in the Panthor DRM driver (drivers/gpu/drm/panthor/panthor_sched.c) between drm_sched_fence_get_timeline_name and group_free_queue. The vulnerability stems from a failure to adhere to dma-fence safe access rules, where a queue might be freed while a dma-fence is still accessing it under an RCU lock. A local attacker with low privileges can exploit this race condition to trigger a use-after-free or null pointer dereference, leading to a system crash (DoS) or potential privilege escalation. The fix introduces synchronize_rcu() in group_release_work to ensure all RCU-protected accesses are complete before freeing the queues. Patches are available in kernel versions 6.18.16, 6.19.6, and 7.0.
Affected products
- Linux Linux Kernel 6.10 to 6.18.15, 6.19 to 6.19.5
Timeline
- 2025-12-04: other: Patch authored
- 2026-05-08: advisory: NVD Published Date
- 2026-03-04: patched: Patch committed to stable branches