Executive brief
A vulnerability in the Linux kernel's Panthor DRM driver could allow a user-space application to cause a system hang or denial of service. By submitting specifically crafted or 'buggy' GPU jobs, an attacker can block the memory subsystem, causing cache flush operations to never complete. This results in the GPU becoming unresponsive and potentially impacting the stability of the entire system.
Technical details
A vulnerability in the panthor_gpu_flush_caches() function in the Linux kernel's Panthor DRM driver allows for a local denial of service. The issue arises when GPU cache flush operations fail to complete, blocking the memory subsystem. Because these hangs can be triggered by user-mode driver (UMD) jobs, a local attacker can cause a kernel hang. The fix introduces a recovery mechanism that schedules a GPU reset, clears pending requests during the reset path, and returns -EIO for subsequent operations to prevent infinite waits. The patch also removes WARN_ON() macros that were previously triggered by these UMD-induced hangs.
Affected products
- Linux Linux Kernel 6.10, 6.11, 6.12
Timeline
- 2025-11-28: patched: Initial patch commit by Boris Brezillon
- 2026-06-03: disclosed: CVE published in NVD dataset