CVE-2025-71307: Linux Kernel Panthor NULL Pointer Vulnerability

CVE-2025-71307 Overview

CVE-2025-71307 is a NULL pointer dereference vulnerability in the Linux kernel's drm/panthor graphics driver. The flaw resides in the panthor_fw_unplug() function, which attempts to halt the Microcontroller Unit (MCU) and wait for the halt to complete during firmware unplug operations. When the MCU is in certain states, or when the firmware has not been loaded or initialized, this halt sequence dereferences a NULL pointer.

The upstream fix removes the MCU halt and wait-for-halt procedures during panthor_fw_unplug(), instead disabling the MCU directly without waiting for confirmation of halt completion.

Critical Impact
A NULL pointer dereference in the panthor GPU driver can trigger a kernel oops or panic, resulting in a local denial-of-service condition on affected Linux systems using ARM Mali GPUs supported by the panthor driver.

Affected Products

Linux kernel versions containing the drm/panthor driver prior to the patched commits
Systems using ARM Mali GPUs driven by the panthor DRM driver
Distributions shipping affected stable kernel releases

Discovery Timeline

2026-05-27 - CVE-2025-71307 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2025-71307

Vulnerability Analysis

The vulnerability exists in the panthor DRM driver, which supports newer ARM Mali GPUs. During the firmware unplug sequence handled by panthor_fw_unplug(), the driver invokes MCU halt logic and waits for the halt operation to complete. This sequence assumes the firmware is loaded and the MCU is in a state capable of responding.

In practice, the MCU can be in a variety of states when unplug is invoked. The firmware may never have been loaded or initialized due to earlier failure paths in the probe sequence. Under those conditions, the halt routine accesses uninitialized data structures and dereferences a NULL pointer, triggering a kernel oops.

The issue is a classic teardown ordering bug. Cleanup code must tolerate partially initialized state, but panthor_fw_unplug() assumed the firmware path had completed successfully [CWE-476].

Root Cause

The root cause is the assumption that the MCU and firmware are in a known good state during unplug. The halt-and-wait procedure dereferences firmware-related pointers without verifying they were allocated and initialized. When unplug runs after a failed or skipped firmware load, those pointers remain NULL.

Attack Vector

Triggering the dereference requires the firmware unplug path to execute while the MCU is not in a state suitable for the halt sequence. This typically occurs during driver unload, device hot-unplug, or error-handling cleanup following a failed probe. Exploitation requires local access and the ability to influence driver lifecycle events. The result is a kernel crash, producing a denial-of-service condition rather than code execution.

The vulnerability mechanism is described in the upstream commit messages. See the Kernel Git Commit Fix and the Kernel Git Commit Update for the patch contents.

Detection Methods for CVE-2025-71307

Indicators of Compromise

Kernel oops or panic messages referencing panthor_fw_unplug in dmesg or /var/log/kern.log
NULL pointer dereference backtraces involving panthor firmware functions
Unexpected GPU driver unload failures or system instability on hosts using ARM Mali GPUs

Detection Strategies

Audit installed kernel versions against the patched stable releases referenced in the upstream commits
Review kernel crash dumps and kdump artifacts for stack traces involving the panthor driver
Correlate driver load and unload events with subsequent kernel instability on systems with Mali GPUs

Monitoring Recommendations

Centralize kernel log collection from Linux endpoints running the panthor driver
Alert on repeated panthor driver oops or panic events that may indicate exploitation attempts or instability
Track kernel package versions across the fleet to identify hosts still running vulnerable builds

How to Mitigate CVE-2025-71307

Immediate Actions Required

Apply the upstream stable kernel patches that remove the MCU halt and wait-for-halt logic from panthor_fw_unplug()
Update to a distribution kernel that incorporates the fix once available from your vendor
Restrict local access to systems running unpatched kernels with the panthor driver loaded

Patch Information

The vulnerability is resolved by the upstream commits aab8b8a42e20 and 920c6af98e98. The fix removes the halt sequence during unplug and disables the MCU directly. Apply the corresponding stable kernel release or the distribution backport once published.

Workarounds

Blacklist the panthor kernel module on systems that do not require Mali GPU acceleration using /etc/modprobe.d/
Avoid driver unload or device hot-unplug operations on affected systems until patches are applied
Limit access to privileged operations that can influence GPU driver lifecycle events

bash

# Blacklist the panthor driver until the kernel is patched
echo "blacklist panthor" | sudo tee /etc/modprobe.d/blacklist-panthor.conf
sudo update-initramfs -u
# Verify kernel version after update
uname -r