A subtle race in the Linux kernel’s Tegra GPU host1x syncpoint allocation and release code was fixed upstream by switching to an atomic kref-based release helper, closing CVE-2025-68732 and eliminating a timing window where a syncpoint could be re-allocated while it was still being cleaned up...