UNKNOWN NVD
CVE-2026-99003
In the Linux kernel, the following vulnerability has been resolved: drm/panthor: validate userspace queue count against initialized firmware slot count In pan
In the Linux kernel, the following vulnerability has been resolved:
drm/panthor: validate userspace queue count against initialized firmware slot count
In panthor_drv.c:panthor_ioctl_group_create(),
the queue count is validated against the hardcoded maximum:
if (!args->queues.count || args->queues.count > MAX_CS_PER_CSG)
return -EINVAL;
However, if the firmware reports fewer slots than MAX_CS_PER_CSG,
panthor_fw_init_ifaces() will only initialize that smaller number of
stream interfaces.
If unprivileged userspace requests more queues than the firmware reported
(but no more than MAX_CS_PER_CSG), cs_slot_prog_locked() fetches an
uninitialized stream interface and may crash when dereferencing
cs_iface->input->ringbuf_base.
References
- https://git.kernel.org/stable/c/4487cf79bf173f2b426a02d102076f8a20d23b96
- https://git.kernel.org/stable/c/9be126be5f78bc331a930295af97c9b1f9158f06
- https://git.kernel.org/stable/c/ec86c43dcfff68eab4db9bdafcd3e2b16e342e18
- https://git.kernel.org/stable/c/fdee3570b282a6c8699aea63fa5694355e010ec9
This unknown severity vulnerability was published on 2026-10-23 via NVD.
vulnfeed aggregates 15176 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.