linux-cve-announce - CVE-2025-68735: drm/panthor: Prevent potential UAF in group creation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025122410-CVE-2025-68735-dce5@gregkh>
Date: Wed, 24 Dec 2025 13:10:11 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2025-68735: drm/panthor: Prevent potential UAF in group creation

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

drm/panthor: Prevent potential UAF in group creation

This commit prevents the possibility of a use after free issue in the
GROUP_CREATE ioctl function, which arose as pointer to the group is
accessed in that ioctl function after storing it in the Xarray.
A malicious userspace can second guess the handle of a group and try
to call GROUP_DESTROY ioctl from another thread around the same time
as GROUP_CREATE ioctl.

To prevent the use after free exploit, this commit uses a mark on an
entry of group pool Xarray which is added just before returning from
the GROUP_CREATE ioctl function. The mark is checked for all ioctls
that specify the group handle and so userspace won't be abe to delete
a group that isn't marked yet.

v2: Add R-bs and fixes tags

The Linux kernel CVE team has assigned CVE-2025-68735 to this issue.

Affected and fixed versions
===========================

	Issue introduced in 6.10 with commit de85488138247d034eb3241840424a54d660926b and fixed in 6.17.13 with commit deb8b2491f6b9882ae02d7dc2651c7bf4f3b7e05
	Issue introduced in 6.10 with commit de85488138247d034eb3241840424a54d660926b and fixed in 6.18.2 with commit c646ebff3fa571e7ea974235286fb9ed3edc260c
	Issue introduced in 6.10 with commit de85488138247d034eb3241840424a54d660926b and fixed in 6.19-rc1 with commit eec7e23d848d2194dd8791fcd0f4a54d4378eecd

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-68735
will be updated if fixes are backported, please check that for the most
up to date information about this issue.

Affected files
==============

The file(s) affected by this issue are:
	drivers/gpu/drm/panthor/panthor_sched.c

Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/deb8b2491f6b9882ae02d7dc2651c7bf4f3b7e05
	https://git.kernel.org/stable/c/c646ebff3fa571e7ea974235286fb9ed3edc260c
	https://git.kernel.org/stable/c/eec7e23d848d2194dd8791fcd0f4a54d4378eecd