CVE-2025-68732

Vulnerability

A race condition exists in the Linux kernel's host1x driver between host1x_syncpt_alloc() and host1x_syncpt_put(). The original code used kref_put() followed by manual mutex locking, which is not atomic. This allows a thread to allocate a syncpoint after its reference count has dropped to zero but before the mutex is acquired by the cleaning thread, leading to a use-after-free scenario.

Exploitation

Exploitation requires local access to the host1x driver, typically through the graphics subsystem. An attacker can trigger concurrent syncpoint allocation and deallocation, for example via crafted IOCTL calls. No special privileges beyond user-level access to the device are needed, but the attack must be timed precisely.

Impact

Successful exploitation can cause memory corruption or a system crash. In a worst-case scenario, an attacker may leverage the use-after-free to execute arbitrary code with kernel privileges, resulting in full system compromise.

Mitigation

The fix, applied in commit [1], replaces kref_put() and manual locking with kref_put_mutex(), ensuring atomic operation. The patch has been backported to stable kernel trees. Users should update to the latest kernel version.