CVE-2025-38596

drm/panthor: Fix UAF in panthor_gem_create_with_handle() debugfs code

published August 19, 2025

CVSS
—
EPSS
0%
Percentile
4.6
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

drm/panthor: Fix UAF in panthor_gem_create_with_handle() debugfs code

The object is potentially already gone after the drm_gem_object_put().

In general the object should be fully constructed before calling

drm_gem_handle_create(), except the debugfs tracking uses a separate

lock and list and separate flag to denotate whether the object is

actually initialized.

Since I'm touching this all anyway simplify this by only adding the

object to the debugfs when it's ready for that, which allows us to

delete that separate flag. panthor_gem_debugfs_bo_rm() already checks

whether we've actually been added to the list or this is some error

path cleanup.

v2: Fix build issues for !CONFIG_DEBUGFS (Adrián)

v3: Add linebreak and remove outdated comment (Liviu)

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00158 · 4.6th percentile
Published
2025-08-19T17:03Z
EPSS history
Timeline
  • 19 AUG 17:03Z
    drm/panthor: Fix UAF in panthor_gem_create_with_handle() debugfs code
    cvelistv5