CVE-2025-71314: Linux Panthor GPU Driver Denial of Service via Cache Flush Timeout

Technical summary

CVE-2025-71314 addresses a denial-of-service condition in the Linux kernel's drm/panthor driver. The vulnerability occurs when panthor_gpu_flush_caches() operations fail to complete, potentially blocking the entire memory subsystem. The fix implements timeout detection and recovery: upon timeout, the driver schedules a GPU reset, clears pending requests to allow new commands post-reset, and short-circuits subsequent flush attempts with -EIO rather than waiting indefinitely. The patch removes WARN_ON() assertions that could be triggered by malformed GPU jobs from userspace drivers, replacing them with error logging to maintain observability without causing kernel warnings.

Business impact

Systems relying on Panthor GPU acceleration (common in mobile and embedded Linux deployments using ARM Mali GPUs) risk graphics subsystem hangs that degrade user experience or cause application crashes. The vulnerability is typically triggered by buggy GPU workloads from userspace drivers, not by remote attack. Recovery requires driver reload or system reboot. Organizations shipping products with affected kernel versions should prioritize patching to improve stability and reduce support burden from graphics-related failures.

Affected systems

The Linux kernel is affected across versions that include the Panthor GPU driver. This primarily impacts systems using ARM Mali GPUs (such as certain Qualcomm, MediaTek, and Samsung SoCs) that rely on the drm/panthor driver for GPU acceleration. Verify your kernel version and GPU driver against the official Linux kernel Git history and your distribution's advisory to confirm exposure.

Exploitability

Exploitation requires local access and the ability to submit GPU workloads. An authenticated user can craft malformed GPU jobs that trigger memory subsystem hangs, causing denial of service to graphics functionality. The vulnerability cannot be exploited remotely and does not lead to code execution or privilege escalation. The impact is confined to availability of GPU services on the affected system.

Remediation

Apply the Linux kernel patch that implements timeout recovery for panthor_gpu_flush_caches() operations. The fix involves: (1) detecting when cache-flush operations time out, (2) scheduling a GPU reset to recover, (3) resetting pending requests before allowing new commands, and (4) returning -EIO for subsequent flush attempts on an already-hung system. Verify the patch version against the official Linux kernel repository and your distribution's security advisories before deployment.

Patch guidance

Obtain the patch from your Linux distribution's security updates or the upstream Linux kernel repository. The vulnerability was introduced in earlier kernel versions and is resolved in patched releases. Coordinate with your device manufacturer or distribution maintainer to confirm patch availability for your specific kernel version and hardware platform. Test the patched kernel in a non-production environment before full deployment, especially if you have custom GPU workloads or drivers.

Detection guidance

Monitor kernel logs for timeout messages related to panthor_gpu_flush_caches() operations. Systems experiencing this vulnerability will show graphics subsystem hangs, GPU reset events, or repeated cache-flush timeout errors in dmesg. GPU monitoring tools and performance profilers may report stalled graphics pipelines. Correlate GPU driver logs with system reboots or graphics service restarts to identify affected deployments. Systems on unpatched kernel versions with workloads exercising GPU memory operations are higher risk.

Why prioritize this

Although rated MEDIUM severity due to local-only access and availability-only impact, this vulnerability affects stability in production deployments using Panthor GPUs. Prioritize patching for systems where graphics performance is critical (automotive infotainment, embedded displays, AI/ML inference on edge devices). Lower priority for server or headless deployments without GPU acceleration. The ease of triggering via userspace GPU jobs makes this a practical concern for systems accepting untrusted workloads.

Risk score, explained

CVSS 3.1 score of 5.5 (MEDIUM) reflects: local attack vector (AV:L) requiring authenticated access (PR:L), low complexity (AC:L), no user interaction (UI:N), isolated impact (S:U), and high availability impact (A:H). The score appropriately captures that this is a denial-of-service condition affecting only GPU graphics availability on the local system, with no confidentiality or integrity compromise. Real-world severity depends on GPU criticality in the deployment context.

Frequently asked questions