Linux Kernel EUVD-2025-209751

Local authenticated user access is required (PR:L in CVSS). The Panthor GPU driver must be compiled into the kernel and active on the system (not default on all architectures - requires Arm Mali GPU hardware or simulation). The vulnerability requires concurrent execution: drm_sched_fence_get_timeline_name() must be called via GPU debugging/query interfaces (sysfs, ioctl, or debugfs) while group_free_queue() executes during GPU context/queue teardown. This race is difficult to trigger reliably without intimate knowledge of GPU scheduler timing. Default kernel configurations on non-GPU systems or systems without Panthor support are not vulnerable. Systems with GPU compute workloads and unprivileged user GPU access are at higher practical risk, though EPSS 0.02% indicates real-world exploitation remains minimal.

CVSS vector AV:L/AC:L/PR:L indicates low-privileged local access with low exploitation complexity, yielding denial of service (A:H indicates high availability impact). However, EPSS score of 0.02% (percentile 4%) signals minimal real-world exploitation likelihood, suggesting this is a correctness/stability issue rather than a practical attack vector. No KEV confirmation, no public POC identified, and no evidence of active exploitation. The race condition requires precise timing and local system access to trigger. SSVC analysis: exploitation is unproven despite being theoretically possible; technical impact is limited to denial of service on GPU operations; automatable exploitation is low due to race condition unpredictability. This represents a kernel stability fix prioritized for code correctness rather than urgent security response.

A local unprivileged user running a GPU application on a system with Panthor driver support could trigger a race condition by rapidly querying GPU fence timeline names while simultaneously triggering GPU queue cleanup operations through other concurrent processes. The timing-dependent race causes the timeline name function to access freed queue memory, resulting in kernel denial of service (hung GPU scheduler, system unresponsiveness for GPU tasks, or potential kernel panic). No public POC exists; exploitation requires understanding kernel GPU scheduler internals and precise timing.