{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-68314","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-12-16T14:48:05.295Z","datePublished":"2025-12-16T15:39:44.791Z","dateUpdated":"2026-08-05T12:10:48.766Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T12:10:48.766Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm: make sure last_fence is always updated\n\nUpdate last_fence in the vm-bind path instead of kernel managed path.\n\nlast_fence is used to wait for work to finish in vm_bind contexts but not\nused for kernel managed contexts.\n\nThis fixes a bug where last_fence is not waited on context close leading\nto faults as resources are freed while in use.\n\nPatchwork: https://patchwork.freedesktop.org/patch/680080/"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerability is reached through DRM MSM render-node ioctls for VM_BIND setup, GPU submission, and context closure, requiring local device access.\nAC:L - The attacker controls the mappings, command stream, workload duration, and close timing; the missing VM_BIND fence update is deterministic and requires no uncontrollable race.\nPR:L - The required ioctls are DRM_RENDER_ALLOW and have no capability check, so any ordinary user granted render-node access can trigger the flaw.\nUI:N - Exploitation requires only attacker-controlled ioctl and close operations, with no victim action.\nS:C - In-flight GPU DMA can survive teardown of its per-process VM mappings and reach recycled pages belonging to the kernel or another client, crossing the GPU/IOMMU isolation boundary.\nC:H - Mapped GEM pages can be released while attacker-programmed GPU reads remain in flight. Reallocation of those pages can expose kernel or other-process memory through a retained shared destination.\nI:H - In-flight GPU writes can target freed pages after they are recycled into kernel or other-client allocations, enabling potentially arbitrary memory corruption.\nA:H - The premature unmapping causes GPU translation faults and hangs that require shared-GPU recovery or reset. An unprivileged attacker can repeat the trigger, potentially making graphics-dependent systems unavailable."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/msm/msm_gem_submit.c"],"versions":[{"version":"92395af63a9958615edfa9d4ef1ea72c92a00410","lessThan":"8ee817ceafba266d9c6f3a09babd2ac7441d9a2b","status":"affected","versionType":"git"},{"version":"92395af63a9958615edfa9d4ef1ea72c92a00410","lessThan":"86404a9e3013d814a772ac407573be5d3cd4ee0d","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/msm/msm_gem_submit.c"],"versions":[{"version":"6.17","status":"affected"},{"version":"0","lessThan":"6.17","status":"unaffected","versionType":"semver"},{"version":"6.17.8","lessThanOrEqual":"6.17.*","status":"unaffected","versionType":"semver"},{"version":"6.18","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.17","versionEndExcluding":"6.17.8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.17","versionEndExcluding":"6.18"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/8ee817ceafba266d9c6f3a09babd2ac7441d9a2b"},{"url":"https://git.kernel.org/stable/c/86404a9e3013d814a772ac407573be5d3cd4ee0d"}],"title":"drm/msm: make sure last_fence is always updated","x_generator":{"engine":"bippy-1.2.0"}}}}