{"id":"CVE-2025-68735","revision":"97550cf7af5d417d863117ae0cf88c11","records":[{"revision":"97550cf7af5d417d863117ae0cf88c11","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-68735","aliases":[],"title":"drm/panthor: Prevent potential UAF in group creation","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/panthor: Prevent potential UAF in group creation\n\nThis commit prevents the possibility of a use after free issue in the\nGROUP_CREATE ioctl function, which arose as pointer to the group is\naccessed in that ioctl function after storing it in the Xarray.\nA malicious userspace can second guess the handle of a group and try\nto call GROUP_DESTROY ioctl from another thread around the same time\nas GROUP_CREATE ioctl.\n\nTo prevent the use after free exploit, this commit uses a mark on an\nentry of group pool Xarray which is added just before returning from\nthe GROUP_CREATE ioctl function. The mark is checked for all ioctls\nthat specify the group handle and so userspace won't be abe to delete\na group that isn't marked yet.\n\nv2: Add R-bs and fixes tags","state":0,"publishedAt":"2025-12-24T12:09:34.364+00:00","modifiedAt":"2026-10-21T12:38:25.918+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/gpu/drm/panthor/panthor_sched.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"de85488138247d034eb3241840424a54d660926b\",\n                            \"lessThan\": \"c6bbec068a9accd6f1df05f3df9a5254c99292ee\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"de85488138247d034eb3241840424a54d660926b\",\n                            \"lessThan\": \"deb8b2491f6b9882ae02d7dc2651c7bf4f3b7e05\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"de85488138247d034eb3241840424a54d660926b\",\n                            \"lessThan\": \"c646ebff3fa571e7ea974235286fb9ed3edc260c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"de85488138247d034eb3241840424a54d660926b\",\n                            \"lessThan\": \"eec7e23d848d2194dd8791fcd0f4a54d4378eecd\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/gpu/drm/panthor/panthor_sched.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.10\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.10\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.114\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.17.13\",\n                            \"lessThanOrEqual\": \"6.17.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.2\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.19\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/c6bbec068a9accd6f1df05f3df9a5254c99292ee","https://git.kernel.org/stable/c/deb8b2491f6b9882ae02d7dc2651c7bf4f3b7e05","https://git.kernel.org/stable/c/c646ebff3fa571e7ea974235286fb9ed3edc260c","https://git.kernel.org/stable/c/eec7e23d848d2194dd8791fcd0f4a54d4378eecd"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-68735","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-68735","identifiers":["CVE-2025-68735"]},"retained":false,"historicalAffected":[]}],"coverage":[]}