Skip to main content

Linux Kernel CVE-2025-68748

HIGH
2025-12-24 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Local access to the panthor driver required (AV:L, PR:L); exploitation is a narrow teardown race, so AC:H; kernel memory corruption yields full C/I/A impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
6.4 MEDIUM
AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 30, 2026 - 06:59 vuln.today
CVE Published
Dec 24, 2025 - 13:16 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/panthor: Fix UAF race between device unplug and FW event processing

The function panthor_fw_unplug() will free the FW memory sections. The problem is that there could still be pending FW events which are yet not handled at this point. process_fw_events_work() can in this case try to access said freed memory.

Simply call disable_work_sync() to both drain and prevent future invocation of process_fw_events_work().

AnalysisAI

Local privilege escalation and memory corruption in the Linux kernel's drm/panthor GPU driver arises from a use-after-free race between device unplug (panthor_fw_unplug()) freeing firmware memory sections and the asynchronous process_fw_events_work() handler, which can still access those freed FW memory regions. An attacker with local access to a system using an ARM Mali CSF-based GPU can potentially corrupt kernel memory or leak information by racing device teardown against pending firmware event processing. CVSS is 7.8 (High) with full confidentiality/integrity/availability impact; no public exploit has been identified and it is not in CISA KEV.

Technical ContextAI

Panthor is the Linux DRM (Direct Rendering Manager) kernel driver for ARM Mali GPUs based on the newer Command Stream Frontend (CSF) architecture (e.g. Mali-G610/G710 and later). The driver loads and manages GPU firmware in dedicated memory sections. The root cause is a classic use-after-free (CWE-416, though the CVE lists CWE as N/A): panthor_fw_unplug() releases the firmware memory during device unplug, but the deferred workqueue item process_fw_events_work() may still be queued or running and dereference that freed memory. The fix calls disable_work_sync() to both drain any in-flight execution and prevent future scheduling of the FW event work before the memory is freed, closing the lifetime gap.

Affected ProductsAI

The vulnerability affects the Linux kernel's drm/panthor driver, used on systems with ARM Mali CSF-architecture GPUs. Exact affected version ranges are not enumerated in the provided data; the four git.kernel.org references (commits 31db188355a4, 5e3ff56d4cb5, 6c1da9ae2c12, 7051f6ba968f) are stable-tree fix/backport commits rather than tagged releases, implying multiple stable branches were patched. No specific CPE strings or vendor advisory URLs beyond the kernel.org commit links were supplied, so precise vulnerable-to-fixed version boundaries should be confirmed against the corresponding stable kernel changelogs.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - update to a Linux kernel build that includes the disable_work_sync() fix, available via the stable-tree commits at https://git.kernel.org/stable/c/6c1da9ae2c123a9ffda5375e64cc81f9ed3cc04a (and backports 31db188355a49337e3e8ec98b99377e482eab22c, 5e3ff56d4cb591daea70786d07dc21d06dc34108, 7051f6ba968fa69918d72cc26de4d6cf7ea05b90); apply your distribution's next stable kernel update that references CVE-2025-68748. As a compensating control where patching is delayed, restrict local access to the affected devices and avoid exposing GPU device unplug/hot-unplug operations to untrusted local users; if the panthor driver is not required, blacklisting the module removes the attack surface entirely at the cost of losing GPU acceleration on Mali CSF hardware. No network-facing mitigation applies since the attack vector is local.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.0/base-os-container:latest Container suse/sl-micro/6.0/kvm-os-container:latest Container suse/sl-micro/6.0/rt-os-container:latest Image SL-Micro Affected
Container suse/sl-micro/6.0/toolbox:latest Affected
Image SLES-Azure-3P Image SLES-Azure-Basic Image SLES-Azure-Standard Image SLES-BYOS-Azure Image SLES-BYOS-EC2 Image SLES-BYOS-GCE Image SLES-CHOST-BYOS-Aliyun Image SLES-CHOST-BYOS-Azure Image SLES-CHOST-BYOS-EC2 Image SLES-CHOST-BYOS-GCE Image SLES-CHOST-BYOS-GDC Image SLES-CHOST-BYOS-SAP-CCloud Image SLES-EC2 Image SLES-EC2-ECS Image SLES-GCE Image SLES-GCE-3P Image SLES-Hardened-BYOS-Azure Image SLES-Hardened-BYOS-EC2 Image SLES-Hardened-BYOS-GCE Image SLES-SAPCAL-Azure Image SLES-SAPCAL-EC2 Image SLES-SAPCAL-GCE Affected
Image SLES-SAP-Azure Image SLES-SAP-Azure-3P Image SLES-SAP-BYOS-Azure Image SLES-SAP-BYOS-EC2 Image SLES-SAP-BYOS-GCE Image SLES-SAP-EC2 Image SLES-SAP-GCE Image SLES-SAP-GCE-3P Affected
SUSE Linux Enterprise High Availability Extension 16.0 Fixed

Share

CVE-2025-68748 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy