PT-2025-33794 · Linux+1 · Linux Kernel+1
Published
2025-07-10
·
Updated
2025-08-19
·
CVE-2025-38596
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions:
Linux kernel (affected versions not specified)
Description:
The Linux kernel contains a use-after-free issue within the
panthor gem create with handle() function related to debugfs code. The vulnerability occurs because an object may be released via drm gem object put() before it is fully constructed, leading to a potential use-after-free condition. The debugfs tracking mechanism uses a separate lock and list, along with a flag to indicate object initialization. The fix simplifies the process by adding the object to debugfs only when it is fully initialized, removing the separate flag and leveraging existing checks in panthor gem debugfs bo rm() to handle error path cleanup.Recommendations:
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Linux Kernel