CVE-2025-38596 Details
Description
In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Fix UAF in panthor_gem_create_with_handle() debugfs code The object is potentially already gone after the drm_gem_object_put(). In general the object should be fully constructed before calling drm_gem_handle_create(), except the debugfs tracking uses a separate lock and list and separate flag to denotate whether the object is actually initialized. Since I'm touching this all anyway simplify this by only adding the object to the debugfs when it's ready for that, which allows us to delete that separate flag. panthor_gem_debugfs_bo_rm() already checks whether we've actually been added to the list or this is some error path cleanup. v2: Fix build issues for !CONFIG_DEBUGFS (Adrián) v3: Add linebreak and remove outdated comment (Liviu)
A use-after-free vulnerability has been addressed in the Linux kernel's Panthor graphics driver. The issue arises in the 'panthor_gem_create_with_handle()' function, where a debugfs object may be released before it is fully initialized. This vulnerability affects the handling of Direct Rendering Manager (DRM) Graphics Execution Manager (GEM) objects, potentially leading to memory management issues. The vulnerability was introduced when the debugfs tracking was separated from the main object initialization process, allowing for objects to be prematurely released. The vulnerability has been fixed by ensuring that objects are only added to the debugfs once they are fully ready, thereby eliminating the need for a separate initialization flag.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/5f2be12442db6a2904e6e31b0e3b5ad5aebf868b | kernel.org | Patch |
| https://git.kernel.org/stable/c/fe69a391808404977b1f002a6e7447de3de7a88e | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-416 | Use After Free | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | 6.16 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 30, 2026 | CVE Modified | kernel.org |
| Jun 17, 2026 | CVE Modified | kernel.org |
| Nov 26, 2025 | Initial Analysis | [email protected] |
| Aug 19, 2025 | New CVE Received | kernel.org |