CVE-2026-99003
Description
In the Linux kernel, the following vulnerability has been resolved: drm/panthor: validate userspace queue count against initialized firmware slot count In panthor_drv.c:panthor_ioctl_group_create(), the queue count is validated against the hardcoded maximum: if (!args->queues.count || args->queues.count > MAX_CS_PER_CSG) return -EINVAL; However, if the firmware reports fewer slots than MAX_CS_PER_CSG, panthor_fw_init_ifaces() will only initialize that smaller number of stream interfaces. If unprivileged userspace requests more queues than the firmware reported (but no more than MAX_CS_PER_CSG), cs_slot_prog_locked() fetches an uninitialized stream interface and may crash when dereferencing cs_iface->input->ringbuf_base.
How to fix
- Linux Linux4487cf79bf173f2b426a02d102076f8a20d23b96, fdee3570b282a6c8699aea63fa5694355e010ec9, 9be126be5f78bc331a930295af97c9b1f9158f06, ec86c43dcfff68eab4db9bdafcd3e2b16e342e18 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | de85488138247d034eb3241840424a54d660926b ≤ v < 4487cf79bf173f2b426a02d102076f8a20d23b96, de85488138247d034eb3241840424a54d660926b ≤ v < fdee3570b282a6c8699aea63fa5694355e010ec9, de85488138247d034eb3241840424a54d660926b ≤ v < 9be126be5f78bc331a930295af97c9b1f9158f06, de85488138247d034eb3241840424a54d660926b ≤ v < ec86c43dcfff68eab4db9bdafcd3e2b16e342e18, 6.10 | 4487cf79bf173f2b426a02d102076f8a20d23b96, fdee3570b282a6c8699aea63fa5694355e010ec9, 9be126be5f78bc331a930295af97c9b1f9158f06, ec86c43dcfff68eab4db9bdafcd3e2b16e342e18 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.