The Linux kernel’s DRM panthor driver contains a race condition between drm_sched_fence_get_timeline_name and group_free_queue. This race can allow a fence to be referenced after its group has been freed, resulting in a use‑after‑free of kernel memory. An attacker able to trigger the race could corrupt kernel memory and cause the system to crash or become unstable.

All Linux kernels that include the DRM panthor driver and have not incorporated commit 506aa8b, which adds safe access helpers for DMA fence. In practice this includes any distribution running a kernel older than the one that introduced that commit.

The CVSS score is 5.5 and the EPSS score is < 1 %. The flaw exists in core kernel code but has no reported exploitation. It is inferred that the vulnerability requires local execution with sufficient privilege to interact with the panthor driver, and could lead to kernel memory corruption and a denial of service. The vulnerability is not listed in CISA’s KEV catalog.