CVE-2025-38596: drm/panthor: Fix UAF in panthor_gem_create_with_handle() debugfs code
In the Linux kernel, the following vulnerability has been resolved:
drm/panthor: Fix UAF in panthorgemcreatewithhandle() debugfs code
The object is potentially already gone after the drmgemobjectput(). In general the object should be fully constructed before calling drmgemhandlecreate(), except the debugfs tracking uses a separate lock and list and separate flag to denotate whether the object is actually initialized.
Since I'm touching this all anyway simplify this by only adding the object to the debugfs when it's ready for that, which allows us to delete that separate flag. panthorgemdebugfsborm() already checks whether we've actually been added to the list or this is some error path cleanup.
v2: Fix build issues for !CONFIGDEBUGFS (Adrián)
v3: Add linebreak and remove outdated comment (Liviu)
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38596?
CVE-2025-38596 is classified as a high severity vulnerability due to its potential for user-after-free (UAF) exploitation in the Linux kernel.
How do I fix CVE-2025-38596?
To fix CVE-2025-38596, users should update their Linux kernel to the latest patched version that contains the fix for this vulnerability.
What systems are affected by CVE-2025-38596?
CVE-2025-38596 affects various versions of the Linux kernel that utilize the drm/panthor debugging functions.
What type of vulnerability is CVE-2025-38596?
CVE-2025-38596 is a user-after-free (UAF) vulnerability that can lead to memory corruption and potential code execution.
When was CVE-2025-38596 reported?
CVE-2025-38596 was reported in the context of recent updates to the Linux kernel, but the exact date is embedded in the ongoing security patch cycle.