Linux Kernel Group Creation Use-After-Free Vulnerability in DRM/Panthor

A use-after-free vulnerability has been addressed in the Linux kernel's GROUP_CREATE ioctl function within the DRM/Panthor driver. This issue arose because a pointer to a group was accessed after being stored in the Xarray, creating a window for exploitation. A malicious userspace could predict the handle of a group and simultaneously invoke the GROUP_DESTROY ioctl from another thread, leading to potential memory corruption. The vulnerability has been mitigated by introducing a marking system on the group pool Xarray, which ensures that a group cannot be deleted before it has been properly initialized and marked. This update is included in the Linux kernel stable tree.

Impact

Exploitation of this vulnerability could lead to a use-after-free condition, allowing for memory corruption and potentially arbitrary code execution.