CVE-2025-68748

Vulnerability

In the Linux kernel's drm/panthor driver, a use-after-free (UAF) race condition exists between device unplug and firmware (FW) event processing. The function panthor_fw_unplug() frees FW memory sections, but pending FW events that have not yet been handled can subsequently access that freed memory, leading to a use-after-free [1].

Exploitation

An attacker with local access and the ability to trigger device unplug while FW events are pending could exploit this race condition. The vulnerability does not require special privileges beyond the ability to interact with the panthor device. The race window is between freeing the memory and the completion of event processing.

Impact

Successful exploitation could lead to memory corruption, system crash, or potentially privilege escalation if an attacker can control the freed memory contents.

Mitigation

The fix, provided in commit [1] and backported to stable trees [2][3][4], replaces the unsynchronized cleanup with disable_work_sync() to drain and prevent future invocation of process_fw_events_work(), ensuring no events are processed after memory is freed. Users should apply the latest kernel updates.