Linux Kernel up to 6.17.12/6.18.1 panthor use after free

Summaryinfo

A vulnerability classified as critical has been found in Linux Kernel up to 6.17.12/6.18.1. Affected by this vulnerability is an unknown functionality of the component panthor. The manipulation leads to use after free. This vulnerability is documented as CVE-2025-68735. There is not any exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Linux Kernel up to 6.17.12/6.18.1. It has been rated as critical. This issue affects some unknown processing of the component panthor. The manipulation with an unknown input leads to a use after free vulnerability. Using CWE to declare the problem leads to CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Prevent potential UAF in group creation This commit prevents the possibility of a use after free issue in the GROUP_CREATE ioctl function, which arose as pointer to the group is accessed in that ioctl function after storing it in the Xarray. A malicious userspace can second guess the handle of a group and try to call GROUP_DESTROY ioctl from another thread around the same time as GROUP_CREATE ioctl. To prevent the use after free exploit, this commit uses a mark on an entry of group pool Xarray which is added just before returning from the GROUP_CREATE ioctl function. The mark is checked for all ioctls that specify the group handle and so userspace won't be abe to delete a group that isn't marked yet. v2: Add R-bs and fixes tags

It is possible to read the advisory at git.kernel.org. The identification of this vulnerability is CVE-2025-68735 since 12/24/2025. The exploitation is known to be easy. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 01/03/2026).

The vulnerability scanner Nessus provides a plugin with the ID 279764 (Linux Distros Unpatched Vulnerability : CVE-2025-68735), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 6.17.13, 6.18.2 or 6.19-rc1 eliminates this vulnerability. Applying the patch deb8b2491f6b9882ae02d7dc2651c7bf4f3b7e05/c646ebff3fa571e7ea974235286fb9ed3edc260c/eec7e23d848d2194dd8791fcd0f4a54d4378eecd is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (279764) and CERT Bund (WID-SEC-2025-2929). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Affected

• Open Source Linux Kernel

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.17.0
• 6.17.1
• 6.17.2
• 6.17.3
• 6.17.4
• 6.17.5
• 6.17.6
• 6.17.7
• 6.17.8
• 6.17.9
• 6.17.10
• 6.17.11
• 6.17.12
• 6.18.0
• 6.18.1

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion