CVE-2026-99003
drm/panthor: validate userspace queue count against initialized firmware slot count
Description
In the Linux kernel, the following vulnerability has been resolved: drm/panthor: validate userspace queue count against initialized firmware slot count In panthor_drv.c:panthor_ioctl_group_create(), the queue count is validated against the hardcoded maximum: if (!args->queues.count || args->queues.count > MAX_CS_PER_CSG) return -EINVAL; However, if the firmware reports fewer slots than MAX_CS_PER_CSG, panthor_fw_init_ifaces() will only initialize that smaller number of stream interfaces. If unprivileged userspace requests more queues than the firmware reported (but no more than MAX_CS_PER_CSG), cs_slot_prog_locked() fetches an uninitialized stream interface and may crash when dereferencing cs_iface->input->ringbuf_base.
Affected products and packages
CNA (CVE.org)
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | affected: de85488138247d034eb3241840424a54d660926b … < 4487cf79bf173f2b426a02d102076f8a20d23b96 affected: de85488138247d034eb3241840424a54d660926b … < fdee3570b282a6c8699aea63fa5694355e010ec9 affected: de85488138247d034eb3241840424a54d660926b … < 9be126be5f78bc331a930295af97c9b1f9158f06 affected: de85488138247d034eb3241840424a54d660926b … < ec86c43dcfff68eab4db9bdafcd3e2b16e342e18 default: unaffected |
| Linux | Linux | affected: 6.10 unaffected: 0 … < 6.10 unaffected: 6.12.113 … <= 6.12.* unaffected: 6.18.57 … <= 6.18.* unaffected: 7.2.11 … <= 7.2.* unaffected: 7.3 … <= * default: affected |
Open-source packages (GitHub Advisory / OSV)
drm/panthor: validate userspace queue count against initialized firmware slot count
| Ecosystem | Package | Affected versions | Fixed in |
|---|---|---|---|
| >= de85488138247d034eb3241840424a54d660926b, < 4487cf79bf173f2b426a02d102076f8a20d23b96; < fdee3570b282a6c8699aea63fa5694355e010ec9; < 9be126be5f78bc331a930295af97c9b1f9158f06; < ec86c43dcfff68eab4db9bdafcd3e2b16e342e18 | 4487cf79bf173f2b426a02d102076f8a20d23b96, fdee3570b282a6c8699aea63fa5694355e010ec9, 9be126be5f78bc331a930295af97c9b1f9158f06, ec86c43dcfff68eab4db9bdafcd3e2b16e342e18 | ||
| Linux | Kernel | >= 6.10.0, < 6.12.113; >= 6.13.0, < 6.18.57; >= 6.19.0, < 7.2.11 | 6.12.113, 6.18.57, 7.2.11 |
Linux distribution status
References (7)
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git OSV
- https://git.kernel.org/stable/c/4487cf79bf173f2b426a02d102076f8a20d23b96 NVD, CNA, OSV
- https://git.kernel.org/stable/c/9be126be5f78bc331a930295af97c9b1f9158f06 NVD, CNA, OSV
- https://git.kernel.org/stable/c/ec86c43dcfff68eab4db9bdafcd3e2b16e342e18 NVD, CNA, OSV
- https://git.kernel.org/stable/c/fdee3570b282a6c8699aea63fa5694355e010ec9 NVD, CNA, OSV
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/99xxx/CVE-2026-99003.json OSV
- https://nvd.nist.gov/vuln/detail/CVE-2026-99003 OSV