CVE-2026-99003drm/panthor: validate userspace queue count against initialized firmware slot count
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: drm/panthor: validate userspace queue count against initialized firmware slot count In panthor_drv.c:panthor_ioctl_group_create(), the queue count is validated against the hardcoded maximum: if (!args->queues.count || args->queues.count > MAX_CS_PER_CSG) return -EINVAL; However, if the firmware reports fewer slots than MAX_CS_PER_CSG, panthor_fw_init_ifaces() will only initialize that smaller number of stream interfaces. If unprivileged userspace requests more queues than the firmware reported (but no more than MAX_CS_PER_CSG), cs_slot_prog_locked() fetches an uninitialized stream interface and may crash when dereferencing cs_iface->input->ringbuf_base.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 23, 2026
- First seen by InfoSec Signals
- Oct 23, 2026
Affected products
Linux Linux linux:linux (from the name) | from de85488138247d034eb3241840424a54d660926b before 4487cf79bf173f2b426a02d102076f8a20d23b96; from de85488138247d034eb3241840424a54d660926b before fdee3570b282a6c8699aea63fa5694355e010ec9; from de85488138247d034eb3241840424a54d660926b before 9be126be5f78bc331a930295af97c9b1f9158f06; from de85488138247d034eb3241840424a54d660926b before ec86c43dcfff68eab4db9bdafcd3e2b16e342e18 | CNA record |
References
- https://git.kernel.org/stable/c/4487cf79bf173f2b426a02d102076f8a20d23b96
- https://git.kernel.org/stable/c/fdee3570b282a6c8699aea63fa5694355e010ec9
- https://git.kernel.org/stable/c/9be126be5f78bc331a930295af97c9b1f9158f06
- https://git.kernel.org/stable/c/ec86c43dcfff68eab4db9bdafcd3e2b16e342e18
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.