CVE-2025-68735

{
  "id": "CVE-2025-68735",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2025-12-24T13:16:28.440",
  "lastModified": "2026-10-21T13:18:24.103",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/panthor: Prevent potential UAF in group creation\n\nThis commit prevents the possibility of a use after free issue in the\nGROUP_CREATE ioctl function, which arose as pointer to the group is\naccessed in that ioctl function after storing it in the Xarray.\nA malicious userspace can second guess the handle of a group and try\nto call GROUP_DESTROY ioctl from another thread around the same time\nas GROUP_CREATE ioctl.\n\nTo prevent the use after free exploit, this commit uses a mark on an\nentry of group pool Xarray which is added just before returning from\nthe GROUP_CREATE ioctl function. The mark is checked for all ioctls\nthat specify the group handle and so userspace won't be abe to delete\na group that isn't marked yet.\n\nv2: Add R-bs and fixes tags"
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndrm/panthor: Prevenir posible UAF en la creación de grupos\n\nEste commit previene la posibilidad de un problema de uso después de liberación en la función ioctl GROUP_CREATE, que surgió porque se accede al puntero al grupo en esa función ioctl después de almacenarlo en el Xarray. Un espacio de usuario malicioso puede adivinar el identificador de un grupo e intentar llamar a la ioctl GROUP_DESTROY desde otro hilo aproximadamente al mismo tiempo que la ioctl GROUP_CREATE.\n\nPara prevenir el exploit de uso después de liberación, este commit utiliza una marca en una entrada del Xarray del pool de grupos que se añade justo antes de regresar de la función ioctl GROUP_CREATE. La marca se verifica para todas las ioctls que especifican el identificador del grupo y así el espacio de usuario no podrá eliminar un grupo que aún no está marcado.\n\nv2: Añadir las etiquetas R-bs y fixes"
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "drivers/gpu/drm/panthor/panthor_sched.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "de85488138247d034eb3241840424a54d660926b",
              "lessThan": "c6bbec068a9accd6f1df05f3df9a5254c99292ee",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "de85488138247d034eb3241840424a54d660926b",
              "lessThan": "deb8b2491f6b9882ae02d7dc2651c7bf4f3b7e05",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "de85488138247d034eb3241840424a54d660926b",
              "lessThan": "c646ebff3fa571e7ea974235286fb9ed3edc260c",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "de85488138247d034eb3241840424a54d660926b",
              "lessThan": "eec7e23d848d2194dd8791fcd0f4a54d4378eecd",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "drivers/gpu/drm/panthor/panthor_sched.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "6.10",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "6.10",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.12.114",
              "lessThanOrEqual": "6.12.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.17.13",
              "lessThanOrEqual": "6.17.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.18.2",
              "lessThanOrEqual": "6.18.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.19",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9
      }
    ]
  },
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/c646ebff3fa571e7ea974235286fb9ed3edc260c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c6bbec068a9accd6f1df05f3df9a5254c99292ee",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/deb8b2491f6b9882ae02d7dc2651c7bf4f3b7e05",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/eec7e23d848d2194dd8791fcd0f4a54d4378eecd",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}