CVE-2025-68747: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68747 is a Use-After-Free (UAF) vulnerability in the Linux kernel's drm/panthor GPU driver, specifically affecting the handling of kernel Buffer Object (BO) Virtual Address (VA) nodes. When panthor_vm_unmap_range() returns an error due to the MMU being down, the original code bailed out early, leaving the va_node inserted in the drm_mm allocator tree. This causes a UAF condition when adjacent nodes are subsequently removed from the drm_mm tree. The vulnerability was introduced in Linux kernel 6.10 (commit 8a1cc07578bf) and affects stable branches up to 6.12.x, 6.17.x, and 6.18.x prior to their respective fixes. It carries an estimated CVSS severity of Medium with an EPSS score of 0.018% (Feedly, EUVD).

The root cause is a Use-After-Free (CWE-416) in the drm/panthor subsystem of the Linux kernel. When the GPU MMU is in a blocked/down state, panthor_vm_unmap_range() may return an error, and the prior code path would abort cleanup prematurely, leaving the va_node still registered in the drm_mm memory manager tree. When other adjacent nodes are later freed and removed from the drm_mm tree, the kernel accesses the already-logically-freed va_node, triggering the UAF. The fix ensures cleanup proceeds regardless of the MMU error return, since a blocked MMU implies the GPU is also blocked and cannot access the physical memory in question (Feedly, Linux Kernel Stable).

Successful exploitation of this UAF vulnerability could allow a local attacker with access to the Panthor GPU driver to cause kernel memory corruption, potentially leading to privilege escalation, system crashes (denial of service), or arbitrary code execution in kernel context. The impact is limited to systems using ARM Mali Panthor GPUs (e.g., certain ARM SoC-based devices running Linux 6.10+). There is no evidence of remote exploitability; local access is required (Feedly).

The Linux kernel maintainers have released patches for all affected stable branches. Fixed versions include Linux 6.12.63, 6.17.13, 6.18.2, and 6.19-rc1. Users should update to the patched kernel versions as soon as possible. The relevant upstream commits are 5a0060ddfc1f (6.12.x), 98dd5143447a (another branch), 0612704b6f6d, and 1123eadb8435 (Linux Kernel Stable, EUVD). As a temporary workaround where patching is not immediately possible, restricting local user access to GPU devices can reduce exposure.