Live › vulnerability › CVE-2026-99003
Go to dashboardThe Panthor DRM driver for Arm Mali GPUs accepts a userspace queue count up to a hardcoded maximum, even when the firmware initialized fewer stream interfaces. Requesting more queues than the firmware reported makes the kernel dereference an uninitialized interface and may crash.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel with the Panthor driver, typically Arm Mali GPU hardware on devices such as some single-board computers and embedded boards. Systems without a Mali GPU using the Panthor driver are unlikely to be exposed. Whether unprivileged local users can reach the ioctl on a given system is not stated in the sources.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
drm/panthor: validate userspace queue count against initialized firmware slot count
In panthor_drv.c:panthor_ioctl_group_create(), the queue count is validated against the hardcoded maximum:
if (!args->queues.count || args->queues.count > MAX_CS_PER_CSG)
return -EINVAL;
However, if the firmware reports fewer slots than MAX_CS_PER_CSG, panthor_fw_init_ifaces() will only initialize that smaller number of stream interfaces.
If unprivileged userspace requests more queues than the firmware reported (but no more than MAX_CS_PER_CSG), cs_slot_prog_locked() fetches an uninitialized stream interface and may crash when dereferencing cs_iface->input->ringbuf_base.
This page as .md · .json · in your agent: get_signal("CVE-2026-99003")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.