Security readout for executives and security teams
Plain-English summary
A race condition in the Linux panthor graphics driver can cause memory to be used after it is freed while collecting fdinfo group statistics. A local, low-privileged user may be able to trigger serious confidentiality, integrity, or availability impacts. Exposure depends on whether the system uses the affected driver and kernel code.
Executive priority
Treat as a high-priority kernel update for systems using panthor, especially where untrusted users can obtain local access. It is not evidenced as remotely exploitable or actively exploited, so validate driver exposure before emergency action. Patch through supported kernel channels after normal compatibility testing.
Technical view
The fdinfo implementation introduced by commit e16635d88fa0 accessed panthor groups without the required xarray lock. Concurrent group removal can therefore race with sample collection and produce a use-after-free. CVSS 3.1 rates it 7.8: local access, low complexity, low privileges, no user interaction, and potentially high impact across confidentiality, integrity, and availability.
Likely exposure
Likely exposure is limited to Linux systems running affected kernel code with the panthor DRM driver present and relevant fdinfo functionality reachable by a local user. The bundle identifies affected 6.13 through 6.15-related entries, but its version formatting is ambiguous; confirm exact fixed builds with the kernel or distribution vendor.
Exploitation context
The supplied record does not identify public exploitation, and CVE-2025-22100 is not marked as included in CISA KEV. The CVSS vector indicates a local, low-privileged attack path without user interaction. No remote attack path is supported by the provided evidence.
Researcher notes
The root issue is synchronization: fdinfo group sampling lacked xarray locking, allowing group lifetime to end during access. The bundle supplies three stable-kernel commits but does not map them clearly to exact fixed release versions. It also provides no proof of exploitability beyond the use-after-free condition and CVSS assessment.
Mitigation direction
- Identify systems using the panthor DRM driver and affected kernel branches.
- Install a vendor-supported kernel containing the referenced upstream or stable fix.
- Prioritize multi-user or otherwise untrusted local-access systems.
- Restrict unnecessary local access until patched where operationally practical.
Validation and detection
- Record the running kernel version and distribution build on potentially exposed systems.
- Confirm whether the panthor driver is present and active.
- Verify the installed kernel includes an applicable referenced fix commit.
- Recheck kernel and distribution advisories because supplied version boundaries are ambiguous.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-22100 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/6d98c83ad67e7bd86a47494fd6c3863e7bb26db9CVE reference, Linux
- https://git.kernel.org/stable/c/e9d45f42a64a400adba59ee83d03e6db662530b4CVE reference, Linux
- https://git.kernel.org/stable/c/0590c94c3596d6c1a3d549ae611366f2ad4e1d8dCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.