Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Prevent potential UAF in group creation This commit prevents the… (CVE-2025-68735)
In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Prevent potential UAF in group creation This commit prevents the possibility of a use after free issue in the GROUP_CREATE ioctl function, which arose as pointer to the group is accessed in that ioctl function after storing it in the Xarray. A malicious userspace can second guess the handle of a group and try to call GROUP_DESTROY ioctl from another thread around the same time as GROUP_CREATE ioctl. To prevent the use after free exploit, this commit uses a mark on an entry of group pool Xarray which is added just before returning from the GROUP_CREATE ioctl function. The mark is checked for all ioctls that specify the group handle and so userspace won't be abe to delete a group that isn't marked yet. v2: Add R-bs and fixes tags
AI Analysis
Technical Summary
CVE-2025-68735 is a use-after-free vulnerability in the Linux kernel drm/panthor driver related to group creation and destruction via ioctl calls. The GROUP_CREATE ioctl stored a pointer to a group in an Xarray but allowed a race condition where a concurrent GROUP_DESTROY ioctl could free the group while it was still accessed, leading to UAF. The patch introduces a mark on the group pool Xarray entry before returning from GROUP_CREATE, which is checked on subsequent ioctls to prevent premature deletion. This mitigates the race condition and prevents exploitation.
Potential Impact
Successful exploitation could allow a local attacker with limited privileges to cause use-after-free conditions, potentially leading to arbitrary code execution, privilege escalation, or denial of service due to memory corruption. The CVSS vector indicates high impact on confidentiality, integrity, and availability.
Mitigation Recommendations
A fix for this vulnerability has been implemented in the Linux kernel drm/panthor driver by adding a marking mechanism to prevent premature group deletion. Users should apply the official kernel updates that include this patch once available. Patch status is not yet confirmed from vendor advisory; check the Linux kernel security advisories for the official fix and update guidance.
Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Prevent potential UAF in group creation This commit prevents the… (CVE-2025-68735)
Description
In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Prevent potential UAF in group creation This commit prevents the possibility of a use after free issue in the GROUP_CREATE ioctl function, which arose as pointer to the group is accessed in that ioctl function after storing it in the Xarray. A malicious userspace can second guess the handle of a group and try to call GROUP_DESTROY ioctl from another thread around the same time as GROUP_CREATE ioctl. To prevent the use after free exploit, this commit uses a mark on an entry of group pool Xarray which is added just before returning from the GROUP_CREATE ioctl function. The mark is checked for all ioctls that specify the group handle and so userspace won't be abe to delete a group that isn't marked yet. v2: Add R-bs and fixes tags
CVSS v3.1
Score 7.8high
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2025-68735 is a use-after-free vulnerability in the Linux kernel drm/panthor driver related to group creation and destruction via ioctl calls. The GROUP_CREATE ioctl stored a pointer to a group in an Xarray but allowed a race condition where a concurrent GROUP_DESTROY ioctl could free the group while it was still accessed, leading to UAF. The patch introduces a mark on the group pool Xarray entry before returning from GROUP_CREATE, which is checked on subsequent ioctls to prevent premature deletion. This mitigates the race condition and prevents exploitation.
Potential Impact
Successful exploitation could allow a local attacker with limited privileges to cause use-after-free conditions, potentially leading to arbitrary code execution, privilege escalation, or denial of service due to memory corruption. The CVSS vector indicates high impact on confidentiality, integrity, and availability.
Mitigation Recommendations
A fix for this vulnerability has been implemented in the Linux kernel drm/panthor driver by adding a marking mechanism to prevent premature group deletion. Users should apply the official kernel updates that include this patch once available. Patch status is not yet confirmed from vendor advisory; check the Linux kernel security advisories for the official fix and update guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-cqpf-ph48-g563
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2025-68735"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6a6b72d29c2644c7f8477cb5
Added to database: 07/30/2026, 15:50:42 UTC
Last enriched: 07/30/2026, 18:54:05 UTC
Last updated: 09/10/2026, 19:36:51 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.