CVE-2025-68735: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68735 is a use-after-free (UAF) vulnerability in the Linux kernel's drm/panthor GPU driver, specifically within the GROUP_CREATE ioctl function. The flaw arises because a pointer to a newly created group is accessed after it has already been stored in the Xarray data structure, creating a race condition window. A malicious local userspace process can exploit this by guessing the group handle and concurrently issuing a GROUP_DESTROY ioctl from another thread, freeing the object while it is still in use. The vulnerability was published on December 24, 2025, and affects Linux kernel versions from the introduction of the panthor driver (around 6.10) up to the fixed releases (Feedly, ENISA EUVD). The CVSS base score has not been formally assigned; Feedly estimates severity as Medium with an EPSS score of 0.017%.

The root cause is a time-of-check to time-of-use (TOCTOU) race condition (CWE-416: Use After Free) in the panthor_group_create() function of the Linux kernel DRM panthor driver. When GROUP_CREATE stores a group pointer into the Xarray and then continues to dereference that pointer, a concurrent GROUP_DESTROY call from another thread can free the underlying memory before the first thread finishes using it. The fix introduces an Xarray mark on the group entry that is set just before GROUP_CREATE returns; all other ioctls that reference a group handle check for this mark before proceeding, preventing deletion of a group that has not yet been fully initialized and marked (Feedly). Exploitation requires local access and the ability to open the DRM device node, making it a local privilege escalation or denial-of-service vector. Patch commits are available at deb8b2491f6b, c646ebff3fa5, and eec7e23d848d in the stable kernel tree (ENISA EUVD).

Successful exploitation of this race condition can lead to kernel memory corruption via a use-after-free, potentially enabling a local attacker to escalate privileges, crash the kernel (denial of service), or leak sensitive kernel memory. The vulnerability is confined to systems running the panthor DRM driver, which supports Arm Mali Valhall and 5th-gen GPU architectures (e.g., devices with Mali G610/G715 GPUs). Lateral movement beyond the affected host is not directly facilitated, but privilege escalation to root could enable further compromise of the system (Feedly).

1. Reconnaissance: Identify a target Linux system running the panthor DRM driver (e.g., a device with an Arm Mali Valhall or 5th-gen GPU such as Mali G610/G715) and confirm local access to the DRM device node (e.g., /dev/dri/renderD128).
2. Open DRM device: Open the panthor DRM device node to obtain a file descriptor for issuing ioctls.
3. Initiate GROUP_CREATE: Issue a GROUP_CREATE ioctl to begin creating a new group. The group pointer is stored in the Xarray before the ioctl fully returns.
4. Race with GROUP_DESTROY: From a second thread, rapidly guess or enumerate the group handle and issue a GROUP_DESTROY ioctl concurrently, attempting to free the group object while the first thread still holds a pointer to it.
5. Trigger UAF: If the race is won, the freed memory is accessed by the first thread, resulting in a use-after-free condition that can corrupt kernel heap memory.
6. Achieve objective: Depending on heap layout and kernel version, leverage the memory corruption to escalate privileges, crash the kernel, or leak sensitive data (Feedly).

• Logs: Kernel oops or BUG messages in dmesg referencing panthor or drm/panthor driver functions, particularly around panthor_group_create or Xarray operations.
• Process: Unusual processes repeatedly opening /dev/dri/renderD* device nodes and issuing rapid ioctl sequences (GROUP_CREATE/GROUP_DESTROY) in tight loops.
• System: Unexpected kernel panics or system instability on devices with Arm Mali Valhall/5th-gen GPUs running unpatched kernel versions.

The fix has been merged into the Linux stable kernel tree. Patched versions include Linux 6.17.13, 6.18.2, and 6.19-rc1 (ENISA EUVD). Administrators should update to a patched kernel version as soon as possible. As a temporary workaround on systems where the panthor driver is not required, the module can be blocklisted (echo 'blacklist panthor' >> /etc/modprobe.d/blacklist.conf) to prevent loading. Distribution-specific updates (e.g., SUSE, Ubuntu) are being tracked and released; users should monitor their vendor's security advisories (Linux Security).

Coverage of CVE-2025-68735 has been limited to automated vulnerability tracking platforms and security news aggregators, with no notable researcher commentary or vendor statements beyond the kernel patch itself. The vulnerability was noted on Bluesky and Mastodon by CVE tracking bots shortly after publication. Pro-Linux.de covered it as part of broader Linux kernel security update roundups (pro-linux.de).