linux-cve-announce - CVE-2025-68748: drm/panthor: Fix UAF race between device unplug and FW event processing

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025122417-CVE-2025-68748-45cb@gregkh>
Date: Wed, 24 Dec 2025 13:10:24 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2025-68748: drm/panthor: Fix UAF race between device unplug and FW event processing

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

drm/panthor: Fix UAF race between device unplug and FW event processing

The function panthor_fw_unplug() will free the FW memory sections.
The problem is that there could still be pending FW events which are yet
not handled at this point. process_fw_events_work() can in this case try
to access said freed memory.

Simply call disable_work_sync() to both drain and prevent future
invocation of process_fw_events_work().

The Linux kernel CVE team has assigned CVE-2025-68748 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.10 with commit de85488138247d034eb3241840424a54d660926b and fixed in 6.12.63 with commit 31db188355a49337e3e8ec98b99377e482eab22c
	Issue introduced in 6.10 with commit de85488138247d034eb3241840424a54d660926b and fixed in 6.17.13 with commit 5e3ff56d4cb591daea70786d07dc21d06dc34108
	Issue introduced in 6.10 with commit de85488138247d034eb3241840424a54d660926b and fixed in 6.18.2 with commit 6c1da9ae2c123a9ffda5375e64cc81f9ed3cc04a
	Issue introduced in 6.10 with commit de85488138247d034eb3241840424a54d660926b and fixed in 6.19-rc1 with commit 7051f6ba968fa69918d72cc26de4d6cf7ea05b90

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-68748
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/gpu/drm/panthor/panthor_sched.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/31db188355a49337e3e8ec98b99377e482eab22c
	https://git.kernel.org/stable/c/5e3ff56d4cb591daea70786d07dc21d06dc34108
	https://git.kernel.org/stable/c/6c1da9ae2c123a9ffda5375e64cc81f9ed3cc04a
	https://git.kernel.org/stable/c/7051f6ba968fa69918d72cc26de4d6cf7ea05b90