CVE-2025-68748

What it actually does

The vulnerability is a use-after-free race in the Linux kernel drm/panthor driver where panthor_fw_unplug() frees FW memory sections while process_fw_events_work() can still access the freed memory due to pending unhandled FW events.

Why it matters to the business

Kernel instability or potential code execution on systems using the affected driver can lead to crashes, denial of service, or elevated privileges, increasing operational risk and requiring urgent patching across Linux deployments.

How an attack unfolds

An attacker triggers a device unplug operation while ensuring pending FW events remain, allowing the work function to dereference freed memory after the unplug completes.

How to fix it

Upgrade affected packages to the listed fixed versions: mercurial (Debian:11) to 5.6.1-4+deb11u1, mercurial (Debian:12) to 6.3.2-1+deb12u1, and mercurial (Debian:13) to 6.9.4-1. Apply the kernel patch that adds disable_work_sync() to drain and block the event work item.

How to confirm the fix worked

Confirm the patch is present by checking for the disable_work_sync() call in panthor_fw_unplug() and verify no UAF reports occur under concurrent unplug and event processing workloads.

Typical attack path

1. Trigger device unplug via panthor_fw_unplug()
2. Leave pending FW events queued
3. Invoke process_fw_events_work() to access freed FW memory sections

How to detect it

Review kernel logs for panthor_fw_unplug and process_fw_events_work activity around device unplug events; inspect for use-after-free warnings or slab corruption in the drm/panthor module.

What your security team should do

• Prioritize kernel updates on all systems exposing the panthor driver
• Monitor for workqueue-related crashes in drm/panthor
• Test the fix in staging environments before broad rollout given the 306-day publication window