Executive brief
The Linux kernel's Panthor GPU driver contains a reference count leak when a GPU work group is evicted before an out-of-memory handler completes. This leak prevents proper resource cleanup and can lead to memory exhaustion or kernel memory pressure over time, affecting systems that rely on GPU scheduling and dynamic resource management.
Technical details
The vulnerability is a reference count leak in the drm/panthor scheduler (drivers/gpu/drm/panthor/panthor_sched.c). When a group is evicted via group_unbind_locked(), the code cancels a pending tiler_oom_work task without releasing the associated group reference that was acquired when the work was queued. The fix checks the return value of cancel_work() and calls group_put() only when the cancellation was effective (work was actually cancelled and not executed). This is a low-level resource management bug with no direct remote exploitability; impact is limited to denial of service through resource exhaustion on systems running affected kernel versions.
Affected products
- Linux Linux kernel 5.x through 7.x (drm/panthor driver)
Timeline
- 2026-06-25: disclosed: Fix committed by Boris Brezillon
- 2026-07-24: patched: Patch merged in stable kernel tree