CVE-2025-71302

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

An attacker reaches the flaw through DRM ioctls on a local Panthor render node and SYNC_IOC_FILE_INFO on an exported sync-file.

AC:LAttack complexity, low

The attacker controls both sides by querying the exported fence concurrently with GROUP_DESTROY or file closure and can repeat the race while spraying reclaimed heap objects.

PR:LPrivileges required, low

All required Panthor, syncobj, and export operations are DRM_RENDER_ALLOW; ordinary-priority groups require neither DRM master nor a capability.

UI:NUser interaction, none

The attacker independently creates the VM, group, job, syncobj, and sync-file and triggers teardown without victim action.

S:UScope, unchanged

The vulnerability compromises resources governed by the same host kernel and does not inherently cross a VM or IOMMU security boundary.

C:HConfidentiality impact, high

The exported scheduler fence can outlive the freed queue, allowing the timeline callback to dereference reclaimed scheduler and name data. Heap reclamation can provide a chosen source pointer whose contents are copied through SYNC_IOC_FILE_INFO, supporting repeated kernel-memory disclosure.

I:HIntegrity impact, high

This is a kernel heap use-after-free involving surviving dma-fence references into reclaimed queue state. Under conservative UAF scoring, attacker-influenced heap reuse is treated as potentially enabling arbitrary memory modification or control-flow hijacking.

A:HAvailability impact, high

Dereferencing a stale or attacker-influenced scheduler-name pointer can cause a kernel fault, oops, or panic, and an unprivileged attacker can trigger the condition repeatedly.