CVE-2025-71314: Linux Kernel Panthor GPU DoS Vulnerability

CVE-2025-71314 Overview

CVE-2025-71314 is a Linux kernel vulnerability in the drm/panthor GPU driver. The flaw occurs when the memory subsystem becomes blocked and cache flush operations issued by panthor_gpu_flush_caches() never complete. Without recovery logic, the driver hangs indefinitely while waiting on operations that cannot succeed. The upstream fix adds a reset path that clears pending_reqs, returns -EIO for subsequent flush requests queued after a timeout, and removes WARN_ON() calls that could be triggered by user-mode driver (UMD) jobs.

Critical Impact

A blocked GPU memory subsystem can stall the panthor driver indefinitely, leading to denial-of-service conditions on systems using affected Mali GPUs.

Affected Products

• Linux kernel versions containing the drm/panthor driver prior to the fix
• Systems using Arm Mali GPUs supported by the Panthor driver
• Distributions packaging affected stable kernel branches

Discovery Timeline

• 2026-06-03 - CVE-2025-71314 published to NVD
• 2026-06-03 - Last updated in NVD database

Technical Details for CVE-2025-71314

Vulnerability Analysis

The vulnerability resides in the panthor_gpu_flush_caches() function within the Direct Rendering Manager (DRM) Panthor driver for Arm Mali GPUs. The driver issues cache flush commands to the GPU and waits for completion. When the GPU memory subsystem enters a blocked state, these flush operations never finish.

The original implementation lacked any timeout-based recovery. As a result, the kernel thread waiting on the flush could stall, and additional queued flush requests would compound the problem with needless waits. The driver also used WARN_ON() macros that could be triggered by malformed GPU jobs submitted from user space, generating noisy kernel logs without addressing the underlying hang.

This class of issue falls under kernel driver denial-of-service and resource exhaustion. The fix introduces a reset path, clears the pending_reqs state on reset, and short-circuits new flush operations with -EIO after a timeout.

Root Cause

The root cause is missing failure-recovery logic in panthor_gpu_flush_caches(). The driver assumed that GPU cache flush operations would always complete, with no provision for blocked memory-subsystem states. Combined with WARN_ON() macros reachable from user-mode driver code paths, malformed GPU jobs could trigger persistent hangs and warning floods.

Attack Vector

A local user with access to the GPU device through the UMD can submit crafted or buggy GPU jobs. These jobs can place the memory subsystem into a state where flush operations never complete, hanging the driver. The vulnerability requires local access to the rendering device and does not provide remote exploitation potential. Refer to the upstream commits (2c899c6, 3c0a601, 57753f2, 8ec4f1b) for the implementation details of the recovery path.

Detection Methods for CVE-2025-71314

Indicators of Compromise

• Kernel log messages from the Panthor driver indicating GPU cache flush timeouts or -EIO returns from flush operations.
• Repeated GPU reset events triggered by the new recovery path in the Panthor driver.
• User-space rendering processes hanging or failing with GPU job submission errors on affected hardware.

Detection Strategies

• Audit installed kernel versions against the patched stable branches referenced in the upstream commits.
• Monitor dmesg and journal output for Panthor driver error messages relating to flush failures, GPU resets, or queued requests aborted with -EIO.
• Correlate GPU driver resets with the processes submitting jobs to identify potentially abusive user-space clients.

Monitoring Recommendations

• Forward kernel ring buffer logs to a centralized logging or SIEM platform for retention and alerting on Panthor driver events.
• Alert on repeated GPU reset cycles within short windows, which can indicate either buggy applications or local abuse.
• Track kernel package versions across the fleet to confirm that patched builds are deployed on systems with Mali GPUs.

How to Mitigate CVE-2025-71314

Immediate Actions Required

• Update the Linux kernel to a stable release containing the Panthor recovery patches referenced in the upstream commits.
• Inventory systems running Arm Mali GPUs that load the panthor kernel module and prioritize them for patching.
• Restrict local access to the DRM render nodes (/dev/dri/renderD*) to trusted users where feasible.

Patch Information

The fix is committed upstream and backported across stable branches. See Kernel Git Commit 2c899c6, Kernel Git Commit 3c0a601, Kernel Git Commit 57753f2, and Kernel Git Commit 8ec4f1b. Apply the distribution kernel update that incorporates these commits.

Workarounds

• If patching is not immediately possible, restrict access to GPU device nodes using filesystem permissions and group membership.
• Avoid running untrusted graphics or compute workloads on hosts with affected Panthor-driver kernels.
• Blacklist the panthor module on systems where the Mali GPU is not required for operation.

# Verify the running kernel version and Panthor module status
uname -r
lsmod | grep panthor

# Restrict access to DRM render nodes to a trusted group
sudo chgrp render /dev/dri/renderD*
sudo chmod 660 /dev/dri/renderD*