Skip to main content

Linux Kernel CVE-2025-68314

HIGH
2025-12-16 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
8.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
8.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
vuln.today AI
7.9 HIGH

Local GPU access required (AV:L, PR:L); reliably triggered on context close (AC:L); described impact is faults so A:H, with C/I:L as plausible UAF side effects, and kernel scope change (S:C).

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 30, 2026 - 07:10 vuln.today
CVE Published
Dec 16, 2025 - 16:16 cve.org
HIGH 8.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/msm: make sure last_fence is always updated

Update last_fence in the vm-bind path instead of kernel managed path.

last_fence is used to wait for work to finish in vm_bind contexts but not used for kernel managed contexts.

This fixes a bug where last_fence is not waited on context close leading to faults as resources are freed while in use.

Patchwork: https://patchwork.freedesktop.org/patch/680080/

AnalysisAI

Privilege-relevant use-after-free in the Linux kernel's drm/msm (Qualcomm Adreno GPU) driver allows a local user with GPU access to trigger kernel faults because last_fence is not waited on at VM-bind context close, freeing GPU resources while they are still in use. Affected systems run the msm DRM driver on Qualcomm SoCs and use vm_bind contexts. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.15%, 5th percentile), consistent with an in-tree kernel fix rather than an in-the-wild threat.

Technical ContextAI

The flaw lives in the DRM (Direct Rendering Manager) subsystem's Qualcomm 'msm' driver, which manages Adreno GPUs found on Snapdragon and other Qualcomm SoCs. The driver tracks a 'last_fence' object to synchronize completion of GPU work submitted through vm_bind contexts (explicit GPU virtual-memory binding). The bug is that last_fence was being updated on the kernel-managed submission path rather than the vm_bind path where it is actually consumed, so on context close the kernel did not wait for outstanding work to complete before tearing down and freeing resources. This is a classic use-after-free (CWE-416) condition - GPU resources are released while still referenced by in-flight operations, causing faults. Note the input lists CWE as N/A and tags it 'Information Disclosure,' but the described root cause is a synchronization/lifetime error leading to use-after-free.

Affected ProductsAI

The Linux kernel is affected, specifically the drm/msm (Qualcomm Adreno GPU) driver when using vm_bind contexts - a relatively recent GPU memory-management feature. No CPE strings were provided in the input, so exact vulnerable version ranges are not enumerated by NVD here; the fix is delivered via the stable tree. The relevant fix commits are https://git.kernel.org/stable/c/86404a9e3013d814a772ac407573be5d3cd4ee0d and https://git.kernel.org/stable/c/8ee817ceafba266d9c6f3a09babd2ac7441d9a2b, and the change is tracked upstream at https://patchwork.freedesktop.org/patch/680080/. Practically, this concerns kernels built with the msm DRM driver running on Qualcomm SoC hardware.

RemediationAI

Apply the upstream kernel fix that updates last_fence in the vm_bind path so outstanding GPU work is waited on before resources are freed; the fix is available as stable commits 86404a9e3013d814a772ac407573be5d3cd4ee0d and 8ee817ceafba266d9c6f3a09babd2ac7441d9a2b (upstream patch https://patchwork.freedesktop.org/patch/680080/). Because these are commit-level references rather than a tagged release, a specific patched version could not be independently confirmed from the input - update to the latest stable kernel from your distribution that incorporates these commits. As a compensating control where patching is delayed, restrict local access to GPU/DRM device nodes (e.g., limit membership of the 'video'/'render' groups and access to /dev/dri render nodes) so only trusted users can submit GPU work; the trade-off is that this can break unprivileged GPU-accelerated applications and containers that legitimately need render-node access.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

CVE-2025-68314 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy