CVE-2026-99003None▾ Sunlit

drm/panthor: validate userspace queue count against initialized firmware slot count

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: validate userspace queue count against initialized firmware slot count In panthor_drv.c:panthor_ioctl_group_create(), the queue count is validated against…

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score3/ 100 · Minimal

impact 2.8 · likelihood 0 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Oct 23, 2026

Updated

Oct 23, 2026

CVSS

—

Vendor

Linux

Product

Linux

CWE

—

Depth score

3 · Minimal

EPSS

0.17% · p6

Platforms

—

Source

CVEORG

Vector

—

EPSS history

Exploit-prediction probability, daily snapshots since Oct 25.

0.2% → 0.2%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

2 events · 2 days

Oct 23, 2026Published
Disclosed via CVEORG
Oct 25, 2026EPSS first tracked
0.2%

Linux #cve.org

Affected

Linux >= de85488138247d034eb3241840424a54d660926b < 4487cf79bf173f2b426a02d102076f8a20d23b96
Linux >= de85488138247d034eb3241840424a54d660926b < fdee3570b282a6c8699aea63fa5694355e010ec9
Linux >= de85488138247d034eb3241840424a54d660926b < 9be126be5f78bc331a930295af97c9b1f9158f06
Linux >= de85488138247d034eb3241840424a54d660926b < ec86c43dcfff68eab4db9bdafcd3e2b16e342e18
Linux 6.10

Full technical detail▾

Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/panthor: validate userspace queue count against initialized firmware slot count

In panthor_drv.c:panthor_ioctl_group_create(), the queue count is validated against the hardcoded maximum:

if (!args->queues.count || args->queues.count > MAX_CS_PER_CSG)
	return -EINVAL;

However, if the firmware reports fewer slots than MAX_CS_PER_CSG, panthor_fw_init_ifaces() will only initialize that smaller number of stream interfaces.

If unprivileged userspace requests more queues than the firmware reported (but no more than MAX_CS_PER_CSG), cs_slot_prog_locked() fetches an uninitialized stream interface and may crash when dereferencing cs_iface->input->ringbuf_base.

Affected

Linux >= de85488138247d034eb3241840424a54d660926b < 4487cf79bf173f2b426a02d102076f8a20d23b96
Linux >= de85488138247d034eb3241840424a54d660926b < fdee3570b282a6c8699aea63fa5694355e010ec9
Linux >= de85488138247d034eb3241840424a54d660926b < 9be126be5f78bc331a930295af97c9b1f9158f06
Linux >= de85488138247d034eb3241840424a54d660926b < ec86c43dcfff68eab4db9bdafcd3e2b16e342e18
Linux 6.10

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#cve.org

drm/panthor: validate userspace queue count against initialized firmware slot count

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score3/ 100 · Minimal

impact 2.8 · likelihood 0 · exploitation 0

Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/panthor: validate userspace queue count against initialized firmware slot count

In panthor_drv.c:panthor_ioctl_group_create(), the queue count is validated against the hardcoded maximum:

if (!args->queues.count || args->queues.count > MAX_CS_PER_CSG) return -EINVAL;

However, if the firmware reports fewer slots than MAX_CS_PER_CSG, panthor_fw_init_ifaces() will only initialize that smaller number of stream interfaces.

Affected

Linux >= de85488138247d034eb3241840424a54d660926b < 4487cf79bf173f2b426a02d102076f8a20d23b96

Linux >= de85488138247d034eb3241840424a54d660926b < fdee3570b282a6c8699aea63fa5694355e010ec9

Linux >= de85488138247d034eb3241840424a54d660926b < 9be126be5f78bc331a930295af97c9b1f9158f06

Linux >= de85488138247d034eb3241840424a54d660926b < ec86c43dcfff68eab4db9bdafcd3e2b16e342e18

Linux 6.10