drm/panthor: Fix UAF on kernel BO VA nodes (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.14 % · percentile 4 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Deferred
Description
In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Fix UAF on kernel BO VA nodes If the MMU is down, panthor_vm_unmap_range() might return an error. We expect the page table to be updated still, and if the MMU is blocked, the rest of the GPU should be blocked too, so no risk of accessing physical memory returned to the system (which the current code doesn't cover for anyway). Proceed with the rest of the cleanup instead of bailing out and leaving the va_node inserted in the drm_mm, which leads to UAF when other adjacent nodes are removed from the drm_mm tree.
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | Linux |
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Secondary) |
European references
- ENISA EUVD · EUVD-2025-205215
- GCVE · GCVE-0-2025-68747
CERT-FR advisories
- CERTFR-2026-AVI-0421 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0397 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0371 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0331 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0128 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0108 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected 8a1cc07578bf42d85f008316873d710ff684dd29 < 5a0060ddfc1fcfdb0f7b4fa1b7b3b0c436151391 ; affected 8a1cc07578bf42d85f008316873d710ff684dd29 < 1123eadb843588b361c96f53a771202b7953154f ; affected 8a1cc07578bf42d85f008316873d710ff684dd29 < 0612704b6f6ddf2ae223019c52148c5ac76cf70e ; affected 8a1cc07578bf42d85f008316873d710ff684dd29 < 98dd5143447af0ee33551776d8b2560c35d0bc4a |
| Linux · Linux | affected 6.10 ; unaffected 0 < 6.10 ; unaffected 6.12.63 ≤ 6.12.* ; unaffected 6.17.13 ≤ 6.17.* ; unaffected 6.18.2 ≤ 6.18.* ; unaffected 6.19 ≤ * |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |