CVE-2025-68748: drm/panthor: Fix UAF race between device unplug and FW event processing
In the Linux kernel, the following vulnerability has been resolved:
drm/panthor: Fix UAF race between device unplug and FW event processing
The function panthorfwunplug() will free the FW memory sections. The problem is that there could still be pending FW events which are yet not handled at this point. processfweventswork() can in this case try to access said freed memory.
Simply call disableworksync() to both drain and prevent future invocation of processfweventswork().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In drm/panthor, ensure panthor_fw_unplug() calls disable_work_sync() to both drain and prevent future process_fw_events_work() from running, so that pending FW events are handled before freeing FW memory sections.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-68748?
CVE-2025-68748 is classified as a medium severity vulnerability due to its potential for exploitation through a use-after-free condition.
How do I fix CVE-2025-68748?
To fix CVE-2025-68748, update the Linux kernel to the latest stable version that includes the patch for the vulnerability.
What types of systems are affected by CVE-2025-68748?
CVE-2025-68748 affects systems running the Linux kernel, specifically those utilizing the drm/panthor device.
What impact does CVE-2025-68748 have on system security?
CVE-2025-68748 can lead to potential memory corruption, which could be exploited to execute arbitrary code or crash the system.
Is there a public exploit for CVE-2025-68748?
As of now, there is no known public exploit for CVE-2025-68748, but users are advised to apply patches as a precaution.