CVE-2025-68735
Description
In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Prevent potential UAF in group creation This commit prevents the possibility of a use after free issue in the GROUP_CREATE ioctl function, which arose as pointer to the group is accessed in that ioctl function after storing it in the Xarray. A malicious userspace can second guess the handle of a group and try to call GROUP_DESTROY ioctl from another thread around the same time as GROUP_CREATE ioctl. To prevent the use after free exploit, this commit uses a mark on an entry of group pool Xarray which is added just before returning from the GROUP_CREATE ioctl function. The mark is checked for all ioctls that specify the group handle and so userspace won't be abe to delete a group that isn't marked yet. v2: Add R-bs and fixes tags
How to fix
- Linux Linuxc6bbec068a9accd6f1df05f3df9a5254c99292ee, deb8b2491f6b9882ae02d7dc2651c7bf4f3b7e05, c646ebff3fa571e7ea974235286fb9ed3edc260c, eec7e23d848d2194dd8791fcd0f4a54d4378eecd or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | de85488138247d034eb3241840424a54d660926b ≤ v < c6bbec068a9accd6f1df05f3df9a5254c99292ee, de85488138247d034eb3241840424a54d660926b ≤ v < deb8b2491f6b9882ae02d7dc2651c7bf4f3b7e05, de85488138247d034eb3241840424a54d660926b ≤ v < c646ebff3fa571e7ea974235286fb9ed3edc260c, de85488138247d034eb3241840424a54d660926b ≤ v < eec7e23d848d2194dd8791fcd0f4a54d4378eecd, 6.10 | c6bbec068a9accd6f1df05f3df9a5254c99292ee, deb8b2491f6b9882ae02d7dc2651c7bf4f3b7e05, c646ebff3fa571e7ea974235286fb9ed3edc260c, eec7e23d848d2194dd8791fcd0f4a54d4378eecd |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.