CVE-2025-68747

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Fix UAF on kernel BO VA nodes If the MMU is down, panthor_vm_unmap_range() might return an error. We expect the page table to be updated still, and if the MMU is blocked, the rest of the GPU should be blocked too, so no risk of accessing physical memory returned to the system (which the current code doesn't cover for anyway). Proceed with the rest of the cleanup instead of bailing out and leaving the va_node inserted in the drm_mm, which leads to UAF when other adjacent nodes are removed from the drm_mm tree.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://git.kernel.org/stable/c/0612704b6f6ddf2ae223019c52148c5ac76cf70e
https://git.kernel.org/stable/c/1123eadb843588b361c96f53a771202b7953154f
https://git.kernel.org/stable/c/5a0060ddfc1fcfdb0f7b4fa1b7b3b0c436151391
https://git.kernel.org/stable/c/98dd5143447af0ee33551776d8b2560c35d0bc4a

Configurations

No configuration.

History

30 Jul 2026, 06:24

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.8

24 Dec 2025, 13:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-12-24 13:16

Updated : 2026-07-30 06:24

NVD link : CVE-2025-68747

Mitre link : CVE-2025-68747

CVE.ORG link : CVE-2025-68747

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2025-68747", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "8a1cc07578bf42d85f008316873d710ff684dd29", "lessThan": "5a0060ddfc1fcfdb0f7b4fa1b7b3b0c436151391", "versionType": "git"}, {"status": "affected", "version": "8a1cc07578bf42d85f008316873d710ff684dd29", "lessThan": "1123eadb843588b361c96f53a771202b7953154f", "versionType": "git"}, {"status": "affected", "version": "8a1cc07578bf42d85f008316873d710ff684dd29", "lessThan": "0612704b6f6ddf2ae223019c52148c5ac76cf70e", "versionType": "git"}, {"status": "affected", "version": "8a1cc07578bf42d85f008316873d710ff684dd29", "lessThan": "98dd5143447af0ee33551776d8b2560c35d0bc4a", "versionType": "git"}], "programFiles": ["drivers/gpu/drm/panthor/panthor_gem.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.10"}, {"status": "unaffected", "version": "0", "lessThan": "6.10", "versionType": "semver"}, {"status": "unaffected", "version": "6.12.63", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.17.13", "versionType": "semver", "lessThanOrEqual": "6.17.*"}, {"status": "unaffected", "version": "6.18.2", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/gpu/drm/panthor/panthor_gem.c"], "defaultStatus": "affected"}]}], "published": "2025-12-24T13:16:29.637", "references": [{"url": "https://git.kernel.org/stable/c/0612704b6f6ddf2ae223019c52148c5ac76cf70e", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/1123eadb843588b361c96f53a771202b7953154f", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/5a0060ddfc1fcfdb0f7b4fa1b7b3b0c436151391", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/98dd5143447af0ee33551776d8b2560c35d0bc4a", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Deferred", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/panthor: Fix UAF on kernel BO VA nodes\n\nIf the MMU is down, panthor_vm_unmap_range() might return an error.\nWe expect the page table to be updated still, and if the MMU is blocked,\nthe rest of the GPU should be blocked too, so no risk of accessing\nphysical memory returned to the system (which the current code doesn't\ncover for anyway).\n\nProceed with the rest of the cleanup instead of bailing out and leaving\nthe va_node inserted in the drm_mm, which leads to UAF when other\nadjacent nodes are removed from the drm_mm tree."}], "lastModified": "2026-07-30T06:24:42.400", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}