All vulnerabilities
CVE-2026-99003

Linux: drm/panthor: validate userspace queue count against initialized firmware slot count

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in4487cf79bf173f2b426a02d102076f8a20d23b96Also 9be126be5f78bc331a930295af97c9b1f9158f06CVE List
Published23 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

  • 4487cf79bf173f2b426a02d102076f8a20d23b96LinuxCVE List
  • 9be126be5f78bc331a930295af97c9b1f9158f06LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/panthor: validate userspace queue count against initialized firmware slot count

In panthor_drv.c:panthor_ioctl_group_create(), the queue count is validated against the hardcoded maximum:

if (!args->queues.count || args->queues.count > MAX_CS_PER_CSG) return -EINVAL;

However, if the firmware reports fewer slots than MAX_CS_PER_CSG, panthor_fw_init_ifaces() will only initialize that smaller number of stream interfaces.

If unprivileged userspace requests more queues than the firmware reported (but no more than MAX_CS_PER_CSG), cs_slot_prog_locked() fetches an uninitialized stream interface and may crash when dereferencing cs_iface->input->ringbuf_base.

Text from CVE List

Affected versions 10

  • Linuxaffected: de85488138247d034eb3241840424a54d660926b before 4487cf79bf173f2b426a02d102076f8a20d23b96CVE List
  • Linuxaffected: de85488138247d034eb3241840424a54d660926b before fdee3570b282a6c8699aea63fa5694355e010ec9CVE List
  • Linuxaffected: de85488138247d034eb3241840424a54d660926b before 9be126be5f78bc331a930295af97c9b1f9158f06CVE List
  • Linuxaffected: de85488138247d034eb3241840424a54d660926b before ec86c43dcfff68eab4db9bdafcd3e2b16e342e18CVE List
  • Linuxaffected: 6.10CVE List
  • Linuxunaffected: all versions before 6.10CVE List
  • Linuxunaffected: 6.12.113 through 6.12.*CVE List
  • Linuxunaffected: 6.18.57 through 6.18.*CVE List
  • Linuxunaffected: 7.2.11 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 4