CVE-2025-38596 (GCVE-0-2025-38596)

Vulnerability from cvelistv5 – Published: 2025-08-19 17:03 – Updated: 2026-08-05 12:03
VLAI
Title
drm/panthor: Fix UAF in panthor_gem_create_with_handle() debugfs code
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Fix UAF in panthor_gem_create_with_handle() debugfs code The object is potentially already gone after the drm_gem_object_put(). In general the object should be fully constructed before calling drm_gem_handle_create(), except the debugfs tracking uses a separate lock and list and separate flag to denotate whether the object is actually initialized. Since I'm touching this all anyway simplify this by only adding the object to the debugfs when it's ready for that, which allows us to delete that separate flag. panthor_gem_debugfs_bo_rm() already checks whether we've actually been added to the list or this is some error path cleanup. v2: Fix build issues for !CONFIG_DEBUGFS (Adrián) v3: Add linebreak and remove outdated comment (Liviu)
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: a3707f53eb3f4f3e7a30d720be0885f813d649bb , < 5f2be12442db6a2904e6e31b0e3b5ad5aebf868b (git)
Affected: a3707f53eb3f4f3e7a30d720be0885f813d649bb , < fe69a391808404977b1f002a6e7447de3de7a88e (git)
Create a notification for this product.
Linux Linux Affected: 6.16
Unaffected: 0 , < 6.16 (semver)
Unaffected: 6.16.1 , ≤ 6.16.* (semver)
Unaffected: 6.17 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/panthor/panthor_gem.c",
            "drivers/gpu/drm/panthor/panthor_gem.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5f2be12442db6a2904e6e31b0e3b5ad5aebf868b",
              "status": "affected",
              "version": "a3707f53eb3f4f3e7a30d720be0885f813d649bb",
              "versionType": "git"
            },
            {
              "lessThan": "fe69a391808404977b1f002a6e7447de3de7a88e",
              "status": "affected",
              "version": "a3707f53eb3f4f3e7a30d720be0885f813d649bb",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/panthor/panthor_gem.c",
            "drivers/gpu/drm/panthor/panthor_gem.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "lessThan": "6.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.1",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/panthor: Fix UAF in panthor_gem_create_with_handle() debugfs code\n\nThe object is potentially already gone after the drm_gem_object_put().\nIn general the object should be fully constructed before calling\ndrm_gem_handle_create(), except the debugfs tracking uses a separate\nlock and list and separate flag to denotate whether the object is\nactually initialized.\n\nSince I\u0027m touching this all anyway simplify this by only adding the\nobject to the debugfs when it\u0027s ready for that, which allows us to\ndelete that separate flag. panthor_gem_debugfs_bo_rm() already checks\nwhether we\u0027ve actually been added to the list or this is some error\npath cleanup.\n\nv2: Fix build issues for !CONFIG_DEBUGFS (Adri\u00e1n)\n\nv3: Add linebreak and remove outdated comment (Liviu)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached through the PANTHOR_BO_CREATE ioctl (plus a concurrent GEM_CLOSE) on the local DRM render device node /dev/dri/renderD*, which requires local system access rather than any network path.\nAC:L - Exploitation is a race between BO_CREATE and GEM_CLOSE that the attacker fully controls from two threads on the same fd, and DRM handle numbers are predictable via the idr allocator, so the window can be won reliably.\nPR:L - The BO_CREATE ioctl is DRM_RENDER_ALLOW, reachable by any unprivileged local user able to open the Panthor render node (render/graphics group on Android/embedded/desktop); no root or capability is needed.\nUI:N - The attacker triggers the ioctl race entirely on its own; no action by any other user is required.\nS:U - The use-after-free corrupts kernel heap within the same kernel security authority, with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - A use-after-free lets the attacker reallocate the freed object slot with attacker-influenced or security-relevant data, which per kernel UAF guidance is treated as enabling arbitrary/high-impact information disclosure.\nI:H - The stale bo-\u003edebugfs.flags write corrupts freed heap memory that can be reallocated to another structure, giving a controlled-timing UAF write primitive leveragable for arbitrary write / control-flow hijack.\nA:H - Writing to freed memory reliably corrupts the kernel heap and causes oops/panic, a high availability impact typical of any use-after-free."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:03:18.312Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5f2be12442db6a2904e6e31b0e3b5ad5aebf868b"
        },
        {
          "url": "https://git.kernel.org/stable/c/fe69a391808404977b1f002a6e7447de3de7a88e"
        }
      ],
      "title": "drm/panthor: Fix UAF in panthor_gem_create_with_handle() debugfs code",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38596",
    "datePublished": "2025-08-19T17:03:26.445Z",
    "dateReserved": "2025-04-16T04:51:24.028Z",
    "dateUpdated": "2026-08-05T12:03:18.312Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38596",
      "date": "2026-08-05",
      "epss": "0.00153",
      "percentile": "0.05002"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38596\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-08-19T17:15:37.480\",\"lastModified\":\"2026-07-30T06:23:29.623\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/panthor: Fix UAF in panthor_gem_create_with_handle() debugfs code\\n\\nThe object is potentially already gone after the drm_gem_object_put().\\nIn general the object should be fully constructed before calling\\ndrm_gem_handle_create(), except the debugfs tracking uses a separate\\nlock and list and separate flag to denotate whether the object is\\nactually initialized.\\n\\nSince I\u0027m touching this all anyway simplify this by only adding the\\nobject to the debugfs when it\u0027s ready for that, which allows us to\\ndelete that separate flag. panthor_gem_debugfs_bo_rm() already checks\\nwhether we\u0027ve actually been added to the list or this is some error\\npath cleanup.\\n\\nv2: Fix build issues for !CONFIG_DEBUGFS (Adri\u00e1n)\\n\\nv3: Add linebreak and remove outdated comment (Liviu)\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/panthor: Correcci\u00f3n de UAF en el c\u00f3digo de debugfs de panthor_gem_create_with_handle(). Es posible que el objeto ya se haya eliminado despu\u00e9s de drm_gem_object_put(). En general, el objeto deber\u00eda estar completamente construido antes de llamar a drm_gem_handle_create(), excepto que el seguimiento de debugfs utiliza un bloqueo, una lista y un indicador independientes para indicar si el objeto se ha inicializado. Dado que estoy trabajando en todo esto, se simplifica a\u00f1adiendo el objeto a debugfs solo cuando est\u00e9 listo, lo que nos permite eliminar ese indicador. panthor_gem_debugfs_bo_rm() ya comprueba si se nos ha a\u00f1adido a la lista o si se trata de una limpieza de la ruta de error. v2: Correcci\u00f3n de problemas de compilaci\u00f3n para !CONFIG_DEBUGFS (Adri\u00e1n). v3: A\u00f1adir salto de l\u00ednea y eliminar comentario obsoleto (Liviu).\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/panthor/panthor_gem.c\",\"drivers/gpu/drm/panthor/panthor_gem.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"a3707f53eb3f4f3e7a30d720be0885f813d649bb\",\"lessThan\":\"5f2be12442db6a2904e6e31b0e3b5ad5aebf868b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a3707f53eb3f4f3e7a30d720be0885f813d649bb\",\"lessThan\":\"fe69a391808404977b1f002a6e7447de3de7a88e\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/panthor/panthor_gem.c\",\"drivers/gpu/drm/panthor/panthor_gem.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.16\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.16\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16.1\",\"lessThanOrEqual\":\"6.16.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D6BFC4F7-7099-4420-AF39-DD1CEABB8DF9\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/5f2be12442db6a2904e6e31b0e3b5ad5aebf868b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fe69a391808404977b1f002a6e7447de3de7a88e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:26:12+00:00",
      "cve": "CVE-2025-38596",
      "id": "CVE-2025-38596",
      "initial_release_date": "2025-08-19T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/panthor: Fix UAF in panthor_gem_create_with_handle() debugfs code",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38596.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-01-23T00:40:09Z",
      "cve": "CVE-2025-38596",
      "id": "CVE-2025-38596",
      "initial_release_date": "2026-01-23T00:40:09Z",
      "product_status:known_not_affected": "346",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-38596",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-38596.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.