Skip to main content

Linux Kernel CVE-2025-68189

HIGH
2025-12-16 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
3.3 LOW

Local DRM access needed (AV:L/PR:L); demonstrated impact is a recoverable kernel WARNING, so A:L and no proven confidentiality/integrity loss (C:N/I:N).

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 30, 2026 - 07:25 vuln.today
CVE Published
Dec 16, 2025 - 14:15 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/msm: Fix GEM free for imported dma-bufs

Imported dma-bufs also have obj->resv != &obj->_resv. So we should check both this condition in addition to flags for handling the _NO_SHARE case.

Fixes this splat that was reported with IRIS video playback:

------------[ cut here ]------------ WARNING: CPU: 3 PID: 2040 at drivers/gpu/drm/msm/msm_gem.c:1127 msm_gem_free_object+0x1f8/0x264 [msm] CPU: 3 UID: 1000 PID: 2040 Comm: .gnome-shell-wr Not tainted 6.17.0-rc7 #1 PREEMPT pstate: 81400005 (Nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) pc : msm_gem_free_object+0x1f8/0x264 [msm] lr : msm_gem_free_object+0x138/0x264 [msm] sp : ffff800092a1bb30 x29: ffff800092a1bb80 x28: ffff800092a1bce8 x27: ffffbc702dbdbe08 x26: 0000000000000008 x25: 0000000000000009 x24: 00000000000000a6 x23: ffff00083c72f850 x22: ffff00083c72f868 x21: ffff00087e69f200 x20: ffff00087e69f330 x19: ffff00084d157ae0 x18: 0000000000000000 x17: 0000000000000000 x16: ffffbc704bd46b80 x15: 0000ffffd0959540 x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 x11: ffffbc702e6cdb48 x10: 0000000000000000 x9 : 000000000000003f x8 : ffff800092a1ba90 x7 : 0000000000000000 x6 : 0000000000000020 x5 : ffffbc704bd46c40 x4 : fffffdffe102cf60 x3 : 0000000000400032 x2 : 0000000000020000 x1 : ffff00087e6978e8 x0 : ffff00087e6977e8 Call trace: msm_gem_free_object+0x1f8/0x264 [msm] (P) drm_gem_object_free+0x1c/0x30 [drm] drm_gem_object_handle_put_unlocked+0x138/0x150 [drm] drm_gem_object_release_handle+0x5c/0xcc [drm] drm_gem_handle_delete+0x68/0xbc [drm] drm_gem_close_ioctl+0x34/0x40 [drm] drm_ioctl_kernel+0xc0/0x130 [drm] drm_ioctl+0x360/0x4e0 [drm] __arm64_sys_ioctl+0xac/0x104 invoke_syscall+0x48/0x104 el0_svc_common.constprop.0+0x40/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x34/0xec el0t_64_sync_handler+0xa0/0xe4 el0t_64_sync+0x198/0x19c ---[ end trace 0000000000000000 ]--- ------------[ cut here ]------------

Patchwork: https://patchwork.freedesktop.org/patch/676273/

AnalysisAI

Improper GEM object cleanup in the Linux kernel's drm/msm (Qualcomm Adreno) graphics driver mishandles imported dma-bufs, because the free path only checked object flags without accounting for imported buffers whose reservation object differs from the embedded default. A local user with DRM/GPU access can trigger the faulty path (reproduced during hardware-accelerated IRIS video playback under GNOME Shell) by closing a GEM handle backed by an imported dma-buf, producing a kernel WARNING at msm_gem.c:1127 and potential incorrect reservation-object handling during buffer teardown. There is no public exploit identified at time of analysis; EPSS is low (0.16%, 6th percentile) and this is not on CISA KEV.

Technical ContextAI

The affected component is the drm/msm DRM/KMS driver that backs Qualcomm Adreno GPUs on Snapdragon-class SoCs. DRM GEM (Graphics Execution Manager) objects carry a dma_resv reservation object used to synchronize access to buffer memory; a locally-created buffer points obj->resv at its embedded &obj->_resv, whereas a buffer imported from another driver via dma-buf sharing points obj->resv at the exporter's reservation object. The bug in msm_gem_free_object() decided how to tear down the _NO_SHARE case by inspecting only the GEM flags, not the obj->resv != &obj->_resv condition that also holds true for imported dma-bufs, so imported buffers took the wrong free path and tripped a WARN_ON. No CWE was assigned, but the root cause is a resource-management/incorrect-state-check class defect in buffer lifecycle handling.

Affected ProductsAI

The Linux kernel's drm/msm driver (Qualcomm Adreno GPU / display) is affected; the reporting reproduced the fault on kernel 6.17.0-rc7 on an arm64 platform during IRIS video decode. No CPE strings were provided in the intelligence, so exact version ranges are not enumerated in the input, but the fix landed via stable-tree commits (git.kernel.org/stable/c/9674c4cb2fe62727a2e4d3f66065ab949dfa61be and git.kernel.org/stable/c/c34e08ba6c0037a72a7433741225b020c989e4ae). The upstream change is tracked at https://patchwork.freedesktop.org/patch/676273/. Deployment is limited to systems running the msm DRM driver, i.e. Qualcomm SoC-based devices (Chromebooks, ARM laptops, embedded/mobile Linux).

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the kernel stable update containing commits 9674c4cb2fe62727a2e4d3f66065ab949dfa61be and c34e08ba6c0037a72a7433741225b020c989e4ae (https://git.kernel.org/stable/c/9674c4cb2fe62727a2e4d3f66065ab949dfa61be and https://git.kernel.org/stable/c/c34e08ba6c0037a72a7433741225b020c989e4ae), or update to the distribution kernel that backports them once released. The patch adds the obj->resv != &obj->_resv check alongside the flag check so imported dma-bufs are freed correctly. If patching must be deferred, the practical compensating control is to limit local access to unprivileged users on affected Qualcomm-SoC systems, since exploitation requires local DRM/render node access; disabling GPU acceleration or the msm driver would avoid the path but breaks display/graphics and is not viable on desktop devices, so it is not a realistic mitigation. No network-facing workaround is applicable because the vector is local.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

CVE-2025-68189 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy