CVE-2026-89825 (GCVE-0-2026-89825)

Vulnerability from cvelistv5 – Published: 2026-09-16 10:30 – Updated: 2026-09-16 14:39
VLAI
Title
drm/panthor: fix firmware control interface bounds checks
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/panthor: fix firmware control interface bounds checks panthor_init_cs_iface() and panthor_init_csg_iface() validate firmware control interface offsets with 32-bit arithmetic and the size of the host wrapper structures. The offsets are derived from firmware-provided strides, so the arithmetic can wrap before the bounds check, and the host wrapper size is not the size of the firmware control interface being mapped. Use 64-bit arithmetic for the computed offsets and validate against the actual firmware control interface structure sizes with subtraction-based bounds checks. Also validate that the shared section is large enough for the global control interface before using it.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 2718d91816eeed03c09c8abe872e45f59078768c , < 33ae55809aee9b4dca1d00cdee35b527f2bf8626 (git)
Affected: 2718d91816eeed03c09c8abe872e45f59078768c , < 80c9528661c774f899281c9a72011208ff39929e (git)
Affected: 2718d91816eeed03c09c8abe872e45f59078768c , < 3e5c7cddc0073eef6f9bb373189b11a969f1f6f6 (git)
Affected: 2718d91816eeed03c09c8abe872e45f59078768c , < 6a47f9fd2d970674ed9dedc52fc7ab76fd015785 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.10
Unaffected: 0 , < 6.10 (semver)
Unaffected: 6.12.110 , ≤ 6.12.* (semver)
Unaffected: 6.18.51 , ≤ 6.18.* (semver)
Unaffected: 7.2.5 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/panthor/panthor_fw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "33ae55809aee9b4dca1d00cdee35b527f2bf8626",
              "status": "affected",
              "version": "2718d91816eeed03c09c8abe872e45f59078768c",
              "versionType": "git"
            },
            {
              "lessThan": "80c9528661c774f899281c9a72011208ff39929e",
              "status": "affected",
              "version": "2718d91816eeed03c09c8abe872e45f59078768c",
              "versionType": "git"
            },
            {
              "lessThan": "3e5c7cddc0073eef6f9bb373189b11a969f1f6f6",
              "status": "affected",
              "version": "2718d91816eeed03c09c8abe872e45f59078768c",
              "versionType": "git"
            },
            {
              "lessThan": "6a47f9fd2d970674ed9dedc52fc7ab76fd015785",
              "status": "affected",
              "version": "2718d91816eeed03c09c8abe872e45f59078768c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/panthor/panthor_fw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.51",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.5",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/panthor: fix firmware control interface bounds checks\n\npanthor_init_cs_iface() and panthor_init_csg_iface() validate firmware\ncontrol interface offsets with 32-bit arithmetic and the size of the host\nwrapper structures. The offsets are derived from firmware-provided strides,\nso the arithmetic can wrap before the bounds check, and the host wrapper\nsize is not the size of the firmware control interface being mapped.\n\nUse 64-bit arithmetic for the computed offsets and validate against the\nactual firmware control interface structure sizes with subtraction-based\nbounds checks. Also validate that the shared section is large enough for\nthe global control interface before using it."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The 32-bit stride overflow is reached only on the local panthor probe path (panthor_probe \u2192 panthor_device_init \u2192 panthor_fw_init \u2192 panthor_fw_start \u2192 panthor_fw_init_ifaces \u2192 panthor_init_csg_iface/panthor_init_cs_iface) when mapping firmware-provided group_stride/stream_stride from mali_csffw.bin; no network, Bluetooth, or USB handler feeds those fields.\nAC:L - Firmware fully controls group_stride, stream_stride, and group_num (MIN_CSGS is 3, so csg_idx\u003e=1 always runs). A crafted stride that places the u32 offset near 2^32 makes offset+sizeof wrap to a small value and pass the bounds check deterministically, with no race or attacker-uncontrollable timing.\nPR:L - The parser applies no capability check to firmware contents. On Mali CSF Android phones, Chromebooks, and embedded boards, mali_csffw.bin commonly lives on vendor/firmware partitions writable by local non-root system or vendor service accounts, which is sufficient to plant the crafted blob before driver probe.\nUI:N - Once the crafted firmware is in place, panthor_fw_init_ifaces() runs automatically at driver probe and caches the resulting interface pointers; no separate victim action such as opening a file, mounting a filesystem, or using /dev/dri is required to trigger the overflow.\nS:U - The bug corrupts kernel memory past the firmware shared-section vmap and can enable local privilege escalation within the host kernel; it does not cross a VM, IOMMU, or sandbox boundary such as a KVM guest-to-host escape.\nC:H - A wrapped u32 iface_offset near 2^32 yields kmap plus a ~4GiB out-of-bounds control pointer; the kernel then reads panthor_fw_*_control_iface fields (input_va, output_va, stream_num, stream_stride, features) from that address, disclosing kernel memory rather than a few bounded bytes.\nI:H - Those OOB control pointers are cached for the device lifetime and consumed by scheduler, job-IRQ, and GROUP_CREATE paths that write panthor_fw_*_input_iface structures and allocate suspend buffers from control-\u003esuspend_size, enabling out-of-bounds kernel writes and control-flow hijacking.\nA:H - Dereferencing kmap plus a wrapped near-4GiB offset can immediately oops or panic if the region is unmapped, and a corrupted firmware interface leaves the Mali GPU unusable; the same path is hit on every probe or firmware boot until the blob is removed."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T14:39:03.420Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/33ae55809aee9b4dca1d00cdee35b527f2bf8626"
        },
        {
          "url": "https://git.kernel.org/stable/c/80c9528661c774f899281c9a72011208ff39929e"
        },
        {
          "url": "https://git.kernel.org/stable/c/3e5c7cddc0073eef6f9bb373189b11a969f1f6f6"
        },
        {
          "url": "https://git.kernel.org/stable/c/6a47f9fd2d970674ed9dedc52fc7ab76fd015785"
        }
      ],
      "title": "drm/panthor: fix firmware control interface bounds checks",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89825",
    "datePublished": "2026-09-16T10:30:57.497Z",
    "dateReserved": "2026-09-11T19:38:34.768Z",
    "dateUpdated": "2026-09-16T14:39:03.420Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89825",
      "date": "2026-09-25",
      "epss": "0.00175",
      "percentile": "0.06205"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/panthor/panthor_fw.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "33ae55809aee9b4dca1d00cdee35b527f2bf8626",
                    "status": "affected",
                    "version": "2718d91816eeed03c09c8abe872e45f59078768c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "80c9528661c774f899281c9a72011208ff39929e",
                    "status": "affected",
                    "version": "2718d91816eeed03c09c8abe872e45f59078768c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3e5c7cddc0073eef6f9bb373189b11a969f1f6f6",
                    "status": "affected",
                    "version": "2718d91816eeed03c09c8abe872e45f59078768c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6a47f9fd2d970674ed9dedc52fc7ab76fd015785",
                    "status": "affected",
                    "version": "2718d91816eeed03c09c8abe872e45f59078768c",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/panthor/panthor_fw.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.10"
                  },
                  {
                    "lessThan": "6.10",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.110",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.51",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/panthor: fix firmware control interface bounds checks\n\npanthor_init_cs_iface() and panthor_init_csg_iface() validate firmware\ncontrol interface offsets with 32-bit arithmetic and the size of the host\nwrapper structures. The offsets are derived from firmware-provided strides,\nso the arithmetic can wrap before the bounds check, and the host wrapper\nsize is not the size of the firmware control interface being mapped.\n\nUse 64-bit arithmetic for the computed offsets and validate against the\nactual firmware control interface structure sizes with subtraction-based\nbounds checks. Also validate that the shared section is large enough for\nthe global control interface before using it."
          }
        ],
        "id": "CVE-2026-89825",
        "lastModified": "2026-09-16T15:18:11.433",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-16T11:16:49.127",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/33ae55809aee9b4dca1d00cdee35b527f2bf8626"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3e5c7cddc0073eef6f9bb373189b11a969f1f6f6"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6a47f9fd2d970674ed9dedc52fc7ab76fd015785"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/80c9528661c774f899281c9a72011208ff39929e"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-17T16:37:54Z",
      "cve": "CVE-2026-89825",
      "id": "CVE-2026-89825",
      "initial_release_date": "2026-09-17T16:37:54Z",
      "product_status:known_not_affected": "347",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89825",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89825.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.