CVE-2025-68732

gpu: host1x: Fix race in syncpt alloc/free

State: Published
Severity: Not scored
Published: Dec 24, 2025
Updated: May 11, 2026
Reserved: Dec 24, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

gpu: host1x: Fix race in syncpt alloc/free

Fix race condition between host1x_syncpt_alloc() and host1x_syncpt_put() by using kref_put_mutex() instead of kref_put() + manual mutex locking.

This ensures no thread can acquire the syncpt_mutex after the refcount drops to zero but before syncpt_release acquires it. This prevents races where syncpoints could be allocated while still being cleaned up from a previous release.

Remove explicit mutex locking in syncpt_release as kref_put_mutex() handles this atomically.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	f5ba33fb9690566c382624637125827b5512e766 to before ca9388fba50dac2eb71c13702b7022a801bef90eAffected f5ba33fb9690566c382624637125827b5512e766 to before 4aeaece518fa4436af93d1d8b786200d9656ff4bAffected f5ba33fb9690566c382624637125827b5512e766 to before 6245cce711e2cdb2cc75c0bb8632952e36f8c972Affected f5ba33fb9690566c382624637125827b5512e766 to before 4e6e07ce0197aecfb6c4a62862acc93b3efedeb7Affected f5ba33fb9690566c382624637125827b5512e766 to before d138f73ffb0c57ded473c577719e6e551b7b1f27Affected f5ba33fb9690566c382624637125827b5512e766 to before 79197c6007f2afbfd7bcf5b9b80ccabf8483d774Affected f5ba33fb9690566c382624637125827b5512e766 to before c7d393267c497502fa737607f435f05dfe6e3d9bAffected
LinuxLinux	5.13Affected before 5.13Not affected 5.15.198 through 5.15.Not affected 6.1.160 through 6.1.Not affected 6.6.120 through 6.6.Not affected 6.12.63 through 6.12.Not affected 6.17.13 through 6.17.Not affected 6.18.2 through 6.18.Not affected 6.19 and laterNot affected

Product

Versions

LinuxLinux

f5ba33fb9690566c382624637125827b5512e766 to before ca9388fba50dac2eb71c13702b7022a801bef90eAffected
f5ba33fb9690566c382624637125827b5512e766 to before 4aeaece518fa4436af93d1d8b786200d9656ff4bAffected
f5ba33fb9690566c382624637125827b5512e766 to before 6245cce711e2cdb2cc75c0bb8632952e36f8c972Affected
f5ba33fb9690566c382624637125827b5512e766 to before 4e6e07ce0197aecfb6c4a62862acc93b3efedeb7Affected
f5ba33fb9690566c382624637125827b5512e766 to before d138f73ffb0c57ded473c577719e6e551b7b1f27Affected
f5ba33fb9690566c382624637125827b5512e766 to before 79197c6007f2afbfd7bcf5b9b80ccabf8483d774Affected
f5ba33fb9690566c382624637125827b5512e766 to before c7d393267c497502fa737607f435f05dfe6e3d9bAffected

LinuxLinux

5.13Affected
before 5.13Not affected
5.15.198 through 5.15.*Not affected
6.1.160 through 6.1.*Not affected
6.6.120 through 6.6.*Not affected
6.12.63 through 6.12.*Not affected
6.17.13 through 6.17.*Not affected
6.18.2 through 6.18.*Not affected
6.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.