CVE-2025-68747

What it actually does

Use-after-free in drm/panthor when panthor_vm_unmap_range returns an error with MMU down, leaving va_node inserted in drm_mm tree so that later removal of adjacent nodes triggers UAF.

Why it matters to the business

Potential kernel instability, crashes, or local privilege escalation on systems using the panthor driver; low exploitability and no known active campaigns reduce immediate risk but still requires patching for affected kernels.

How an attack unfolds

An attacker triggers an MMU-down condition, forces panthor_vm_unmap_range to fail, leaves the va_node in the drm_mm tree, then performs operations that remove neighboring nodes to dereference the freed object and achieve code execution or denial of service.

How to fix it

Apply the upstream fix present in commit cb695e653a08af4cabcb277c271ce74bd0c746e6; update the Linux kernel containing the panthor driver to a version that includes this change.

How to confirm the fix worked

Confirm the panthor driver source contains the corrected unmap-range error handling that always proceeds with va_node cleanup; verify the drm_mm tree no longer retains nodes after an unmap error.

Typical attack path

1. Obtain local access or ability to interact with the panthor GPU driver
2. Force or wait for MMU-down state
3. Invoke panthor_vm_unmap_range so that it returns an error
4. Trigger removal of adjacent drm_mm nodes
5. Exploit the resulting use-after-free for privilege escalation or crash

How to detect it

Review kernel logs for panthor and drm_mm related errors or warnings around unmap operations; inspect for unexpected GPU driver crashes or UAF reports in dmesg after MMU state changes.

What your security team should do

• Prioritize kernel updates on systems exposing the panthor driver
• Monitor for any new EPSS increase or KEV addition
• Test the fix in staging environments before broad deployment