Security readout for executives and security teams
Plain-English summary
A timing flaw in Linux’s Panthor graphics driver can let background firmware work access memory after device removal has freed it, potentially crashing or corrupting the kernel. Successful abuse could affect confidentiality, integrity, and availability. Treat it as high severity on systems using this driver. The sources do not establish remote reachability or active exploitation.
Executive priority
Address within the high-severity kernel patch cycle, accelerating systems that actively use Panthor graphics support. Internet-facing status alone does not determine exposure because the assessed attack vector is local. Confirm driver usage and vendor backport status before declaring systems affected or remediated.
Technical view
A race between panthor_fw_unplug() and process_fw_events_work() creates a use-after-free condition: unplug frees firmware memory sections while pending firmware events may still reference them. The published correction calls disable_work_sync() to drain existing event work and prevent later invocation before memory is released.
Likely exposure
Exposure is likely limited to Linux hosts running an affected kernel with drm/panthor present and handling relevant device teardown activity. The bundle lists several versions but does not provide clear range semantics or distro backport status. Kernel version strings alone are therefore insufficient for determining vulnerability.
Exploitation context
The CVSS assessment describes a local, low-privilege attack path requiring no user interaction. KEV is false, and no supplied source reports active exploitation or a public exploit. The bundle does not establish how reliably an unprivileged user can trigger the race in real deployments.
Researcher notes
No CWE is assigned in the bundle, although the described defect is a use-after-free race. The central remediation invariant is that firmware event work must be synchronously drained and disabled before firmware memory sections are freed. Affected-version data is ambiguous, and practical triggerability is not documented, limiting exploitability conclusions.
Mitigation direction
- Install a vendor-supported kernel containing the applicable upstream stable correction.
- Prioritize systems where drm/panthor is enabled, loaded, or bound to hardware.
- Follow distribution guidance for backported fixes; do not rely solely on upstream version numbers.
- Reboot affected systems into the corrected kernel after installation.
Validation and detection
- Record the running kernel build and package revision on potentially affected Linux hosts.
- Confirm whether drm/panthor is configured, loaded, or bound to a device.
- Verify vendor changelogs or source contain a cited stable commit or equivalent backport.
- Confirm updated hosts booted the corrected kernel rather than an older installed image.
- Review kernel logs and crash reports for Panthor firmware-event or use-after-free indicators.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-68748 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/31db188355a49337e3e8ec98b99377e482eab22cCVE reference, Linux
- https://git.kernel.org/stable/c/5e3ff56d4cb591daea70786d07dc21d06dc34108CVE reference, Linux
- https://git.kernel.org/stable/c/6c1da9ae2c123a9ffda5375e64cc81f9ed3cc04aCVE reference, Linux
- https://git.kernel.org/stable/c/7051f6ba968fa69918d72cc26de4d6cf7ea05b90CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.