{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2025-22100",
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "state": "PUBLISHED",
        "assignerShortName": "Linux",
        "dateReserved": "2024-12-29T08:45:45.819Z",
        "datePublished": "2025-04-16T14:12:49.851Z",
        "dateUpdated": "2026-08-05T11:56:46.364Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
                "shortName": "Linux",
                "dateUpdated": "2026-08-05T11:56:46.364Z"
            },
            "descriptions": [
                {
                    "lang": "en",
                    "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/panthor: Fix race condition when gathering fdinfo group samples\n\nCommit e16635d88fa0 (\"drm/panthor: add DRM fdinfo support\") failed to\nprotect access to groups with an xarray lock, which could lead to\nuse-after-free errors."
                }
            ],
            "metrics": [
                {
                    "cvssV3_1": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                        "baseScore": 7.8,
                        "baseSeverity": "HIGH"
                    },
                    "scenarios": [
                        {
                            "lang": "en",
                            "value": "AV:L - Exploitation requires local access to the panthor DRM render node (/dev/dri/renderD*) for the GROUP_CREATE/GROUP_DESTROY ioctls and a read of /proc/<pid>/fdinfo for the same fd. There is no network-reachable path into this GPU driver.\nAC:L - The attacker controls both sides of the race, spinning one thread on read() of its own fdinfo while another thread loops GROUP_CREATE/GROUP_DESTROY, so the window can be hit repeatedly and at will. Groups with no submitted jobs are freed synchronously on destroy, making the window wide and reproducible.\nPR:L - Both the GROUP_CREATE and GROUP_DESTROY ioctls are DRM_RENDER_ALLOW, requiring no DRM master or authentication, and any process can read its own /proc/self/fdinfo. On Android, Chromebooks and embedded Mali-CSF systems ordinary unprivileged apps hold render-node access.\nUI:N - The attacking process performs every step itself — opening the render node, creating and destroying the group, and reading its own fdinfo. No victim action is involved.\nS:U - The use-after-free corrupts kernel slab memory within the same security authority; there is no VM, IOMMU or sandbox boundary crossed.\nC:H - The loop reads two u64 fields out of the freed panthor_group and the values are printed straight back to userspace as drm-cycles-panthor/drm-engine-panthor, leaking reallocated heap contents including potential kernel pointers, and a UAF generally yields an arbitrary-read primitive via heap grooming.\nI:H - The loop body writes into the freed object — mutex_lock/unlock on group->fdinfo.lock plus zeroing of the data fields — corrupting whatever structure reuses the slab, which is a classic path to control-flow hijack via heap spraying.\nA:H - Dereferencing and locking a freed mutex reliably produces a kernel oops or panic, and the corrupted lock state can additionally hang tasks waiting on it."
                        }
                    ]
                }
            ],
            "affected": [
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "unaffected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "drivers/gpu/drm/panthor/panthor_sched.c"
                    ],
                    "versions": [
                        {
                            "version": "e16635d88fa07ba5801aa9e57ad7fe3c053234e4",
                            "lessThan": "6d98c83ad67e7bd86a47494fd6c3863e7bb26db9",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "e16635d88fa07ba5801aa9e57ad7fe3c053234e4",
                            "lessThan": "e9d45f42a64a400adba59ee83d03e6db662530b4",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "e16635d88fa07ba5801aa9e57ad7fe3c053234e4",
                            "lessThan": "0590c94c3596d6c1a3d549ae611366f2ad4e1d8d",
                            "status": "affected",
                            "versionType": "git"
                        }
                    ]
                },
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "affected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "drivers/gpu/drm/panthor/panthor_sched.c"
                    ],
                    "versions": [
                        {
                            "version": "6.13",
                            "status": "affected"
                        },
                        {
                            "version": "0",
                            "lessThan": "6.13",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.13.11",
                            "lessThanOrEqual": "6.13.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.14.2",
                            "lessThanOrEqual": "6.14.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.15",
                            "lessThanOrEqual": "*",
                            "status": "unaffected",
                            "versionType": "original_commit_for_fix"
                        }
                    ]
                }
            ],
            "cpeApplicability": [
                {
                    "nodes": [
                        {
                            "operator": "OR",
                            "negate": false,
                            "cpeMatch": [
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.13",
                                    "versionEndExcluding": "6.13.11"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.13",
                                    "versionEndExcluding": "6.14.2"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.13",
                                    "versionEndExcluding": "6.15"
                                }
                            ]
                        }
                    ]
                }
            ],
            "references": [
                {
                    "url": "https://git.kernel.org/stable/c/6d98c83ad67e7bd86a47494fd6c3863e7bb26db9"
                },
                {
                    "url": "https://git.kernel.org/stable/c/e9d45f42a64a400adba59ee83d03e6db662530b4"
                },
                {
                    "url": "https://git.kernel.org/stable/c/0590c94c3596d6c1a3d549ae611366f2ad4e1d8d"
                }
            ],
            "title": "drm/panthor: Fix race condition when gathering fdinfo group samples",
            "x_generator": {
                "engine": "bippy-1.2.0"
            }
        }
    }
}