CVE-2025-68748: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68748 is a Use-After-Free (UAF) race condition vulnerability in the Linux kernel's drm/panthor DRM driver, specifically between device unplug and firmware (FW) event processing. When panthor_fw_unplug() frees firmware memory sections, pending FW events not yet handled by process_fw_events_work() can attempt to access the already-freed memory, resulting in a UAF condition. The vulnerability was published on December 24, 2025, and affects Linux kernel versions starting from commit de85488138247d034eb3241840424a54d660926b. The CVSS estimated severity is Medium, with an EPSS score of approximately 0.018% (Feedly, EUVD).

The root cause is a race condition (CWE-416: Use After Free) in the drm/panthor subsystem of the Linux kernel. When a Panthor GPU device is unplugged, panthor_fw_unplug() frees firmware memory sections without ensuring that all pending work items referencing those sections have completed. The process_fw_events_work() work queue handler can then be scheduled and execute after the memory has been freed, leading to a UAF dereference. The fix involves calling disable_work_sync() to both drain any in-flight invocations of process_fw_events_work() and prevent future scheduling of the work item before the memory is freed (Feedly, Kernel Git).

Successful exploitation of this UAF race condition could lead to kernel memory corruption, potentially resulting in a system crash (denial of service) or, in more severe scenarios, privilege escalation or arbitrary code execution in kernel context. The vulnerability is local in nature and primarily affects systems using Arm Panthor GPU hardware (e.g., devices with Mali Valhall or newer Arm GPUs supported by the panthor driver). The scope is limited to systems where an attacker can trigger device unplug events while firmware event processing is active (Feedly).

The Linux kernel has released patches addressing this vulnerability across multiple stable branches. Fixed versions include Linux 6.12.63, 6.17.13, 6.18.2, and 6.19-rc1. The fix is implemented via the commits 31db188355a4, 5e3ff56d4cb5, 6c1da9ae2c12, and 7051f6ba968f in the stable kernel tree. Users and administrators running systems with Panthor GPU hardware should update to a patched kernel version as soon as possible. Distribution-specific updates (e.g., Red Hat, Debian, Ubuntu) should be applied as they become available (Feedly, EUVD).

The vulnerability received routine coverage from automated vulnerability tracking services and security aggregators shortly after its December 24, 2025 publication. No notable researcher commentary, vendor statements beyond the kernel fix, or significant media coverage has been identified for this vulnerability (Feedly).