Linux Kernel CVE-2025-68735

Requires local access to a system running the Linux kernel with the drm/panthor driver loaded (i.e. Arm Mali CSF-class GPU hardware) and the ability to open the panthor DRM render node and issue its ioctls - the CVSS PR:L reflects that some privilege/group membership (render/video) is needed, so this is not unauthenticated. The attacker must concurrently invoke GROUP_CREATE and GROUP_DESTROY from separate threads and guess/second-guess the group handle to hit the pre-mark window. Limiting factors: it is a timing-dependent race (must win a narrow window, making reliable exploitation harder), requires local not remote access, requires the specific panthor driver and Mali hardware to be present, and depends on the target kernel predating the referenced stable fixes.

The supplied CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N, C:H/I:H/A:H, score 7.8) rates this a high-severity local escalation, but two signals temper it. First, the vulnerability is a race condition - reliable exploitation requires winning a narrow timing window between GROUP_CREATE and GROUP_DESTROY while correctly guessing the group handle, which realistically warrants AC:H rather than the input's AC:L. Second, the intelligence tags label this 'Denial Of Service', which is more conservative than the C:H/I:H/A:H kernel-UAF impact; kernel UAFs are frequently escalatable to code execution, so the true ceiling is likely higher than DoS but reliable EoP is not demonstrated here. No EPSS score, no CISA KEV entry, and no public PoC were provided, so this is not evidence of active or imminent widespread exploitation. Net: a legitimate patch-worthy local-privilege issue on systems that actually load the panthor driver, but not an emergency for the broader fleet, and the exact impact (DoS vs. full EoP) should be verified against the kernel commit.

A logged-in local user (or code running inside a sandbox/app that has GPU render-node access) on an Arm device with a Mali CSF GPU spawns two threads: one repeatedly calling GROUP_CREATE and another calling GROUP_DESTROY on the guessed handle, racing to free the group while the create path still references it. Winning the race triggers a kernel use-after-free that can crash the system or, with heap grooming, potentially be steered toward privilege escalation. No public PoC was identified in the provided data.