CVE-2025-38596 (GCVE-0-2025-38596)
Vulnerability from cvelistv5
Published
2025-08-19 17:03
Modified
2025-08-19 17:03
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Fix UAF in panthor_gem_create_with_handle() debugfs code The object is potentially already gone after the drm_gem_object_put(). In general the object should be fully constructed before calling drm_gem_handle_create(), except the debugfs tracking uses a separate lock and list and separate flag to denotate whether the object is actually initialized. Since I'm touching this all anyway simplify this by only adding the object to the debugfs when it's ready for that, which allows us to delete that separate flag. panthor_gem_debugfs_bo_rm() already checks whether we've actually been added to the list or this is some error path cleanup. v2: Fix build issues for !CONFIG_DEBUGFS (Adrián) v3: Add linebreak and remove outdated comment (Liviu)
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/5f2be12442db6a2904e6e31b0e3b5ad5aebf868b
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/fe69a391808404977b1f002a6e7447de3de7a88e
Impacted products
Vendor Product Version
Linux Linux Version: a3707f53eb3f4f3e7a30d720be0885f813d649bb
Version: a3707f53eb3f4f3e7a30d720be0885f813d649bb
 Create a notification for this product.
   Linux Linux Version: 6.16
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/panthor/panthor_gem.c",
            "drivers/gpu/drm/panthor/panthor_gem.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5f2be12442db6a2904e6e31b0e3b5ad5aebf868b",
              "status": "affected",
              "version": "a3707f53eb3f4f3e7a30d720be0885f813d649bb",
              "versionType": "git"
            },
            {
              "lessThan": "fe69a391808404977b1f002a6e7447de3de7a88e",
              "status": "affected",
              "version": "a3707f53eb3f4f3e7a30d720be0885f813d649bb",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/panthor/panthor_gem.c",
            "drivers/gpu/drm/panthor/panthor_gem.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "lessThan": "6.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.1",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17-rc1",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/panthor: Fix UAF in panthor_gem_create_with_handle() debugfs code\n\nThe object is potentially already gone after the drm_gem_object_put().\nIn general the object should be fully constructed before calling\ndrm_gem_handle_create(), except the debugfs tracking uses a separate\nlock and list and separate flag to denotate whether the object is\nactually initialized.\n\nSince I\u0027m touching this all anyway simplify this by only adding the\nobject to the debugfs when it\u0027s ready for that, which allows us to\ndelete that separate flag. panthor_gem_debugfs_bo_rm() already checks\nwhether we\u0027ve actually been added to the list or this is some error\npath cleanup.\n\nv2: Fix build issues for !CONFIG_DEBUGFS (Adri\u00e1n)\n\nv3: Add linebreak and remove outdated comment (Liviu)"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-19T17:03:26.445Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5f2be12442db6a2904e6e31b0e3b5ad5aebf868b"
        },
        {
          "url": "https://git.kernel.org/stable/c/fe69a391808404977b1f002a6e7447de3de7a88e"
        }
      ],
      "title": "drm/panthor: Fix UAF in panthor_gem_create_with_handle() debugfs code",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38596",
    "datePublished": "2025-08-19T17:03:26.445Z",
    "dateReserved": "2025-04-16T04:51:24.028Z",
    "dateUpdated": "2025-08-19T17:03:26.445Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38596\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-08-19T17:15:37.480\",\"lastModified\":\"2025-08-20T14:40:17.713\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/panthor: Fix UAF in panthor_gem_create_with_handle() debugfs code\\n\\nThe object is potentially already gone after the drm_gem_object_put().\\nIn general the object should be fully constructed before calling\\ndrm_gem_handle_create(), except the debugfs tracking uses a separate\\nlock and list and separate flag to denotate whether the object is\\nactually initialized.\\n\\nSince I\u0027m touching this all anyway simplify this by only adding the\\nobject to the debugfs when it\u0027s ready for that, which allows us to\\ndelete that separate flag. panthor_gem_debugfs_bo_rm() already checks\\nwhether we\u0027ve actually been added to the list or this is some error\\npath cleanup.\\n\\nv2: Fix build issues for !CONFIG_DEBUGFS (Adri\u00e1n)\\n\\nv3: Add linebreak and remove outdated comment (Liviu)\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/panthor: Correcci\u00f3n de UAF en el c\u00f3digo de debugfs de panthor_gem_create_with_handle(). Es posible que el objeto ya se haya eliminado despu\u00e9s de drm_gem_object_put(). En general, el objeto deber\u00eda estar completamente construido antes de llamar a drm_gem_handle_create(), excepto que el seguimiento de debugfs utiliza un bloqueo, una lista y un indicador independientes para indicar si el objeto se ha inicializado. Dado que estoy trabajando en todo esto, se simplifica a\u00f1adiendo el objeto a debugfs solo cuando est\u00e9 listo, lo que nos permite eliminar ese indicador. panthor_gem_debugfs_bo_rm() ya comprueba si se nos ha a\u00f1adido a la lista o si se trata de una limpieza de la ruta de error. v2: Correcci\u00f3n de problemas de compilaci\u00f3n para !CONFIG_DEBUGFS (Adri\u00e1n). v3: A\u00f1adir salto de l\u00ednea y eliminar comentario obsoleto (Liviu).\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/5f2be12442db6a2904e6e31b0e3b5ad5aebf868b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/fe69a391808404977b1f002a6e7447de3de7a88e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.