CVE-2025-68748 describes a use-after-free race condition in the Linux kernel's drm/panthor driver. Specifically, the panthor_fw_unplug() function frees firmware memory sections, but pending firmware events may still be processed by process_fw_events_work(), which can access freed memory. The fix involves calling disable_work_sync() to drain and prevent further invocations of process_fw_events_work(), thereby eliminating the race condition.

Successful exploitation could lead to memory corruption with high impact on confidentiality, integrity, and availability of the affected system, as indicated by the CVSS vector (C:H/I:H/A:H). This could allow an attacker with local privileges to cause system crashes or potentially execute arbitrary code.

A fix for this vulnerability has been implemented by adding synchronization to prevent the race condition. Since no explicit patch links or vendor advisories are provided, check the official Linux kernel repositories or vendor advisories for the updated drm/panthor driver version containing this fix and apply it promptly. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.