{"id":"CVE-2026-99003","kind":"vulnerability","aliases":["CVE-2026-99003"],"related":[],"title":"Linux kernel Panthor GPU driver: unchecked queue count can crash the system","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/panthor: validate userspace queue count against initialized firmware slot count\n\nIn panthor_drv.c:panthor_ioctl_group_create(),\nthe queue count is validated against the hardcoded maximum:\n\n\tif (!args->queues.count || args->queues.count > MAX_CS_PER_CSG)\n\t\treturn -EINVAL;\n\nHowever, if the firmware reports fewer slots than MAX_CS_PER_CSG,\npanthor_fw_init_ifaces() will only initialize that smaller number of\nstream interfaces.\n\nIf unprivileged userspace requests more queues than the firmware reported\n(but no more than MAX_CS_PER_CSG), cs_slot_prog_locked() fetches an\nuninitialized stream interface and may crash when dereferencing\ncs_iface->input->ringbuf_base.","summary":"The Panthor DRM driver for Arm Mali GPUs accepts a userspace queue count up to a hardcoded maximum, even when the firmware initialized fewer stream interfaces. Requesting more queues than the firmware reported makes the kernel dereference an uninitialized interface and may crash.","severity":"unknown","cvss":null,"epss":0.00209,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["arm-mali","embedded","linux-kernel","runtime","single-board-computer"],"not_affected_if":["no-panthor-driver"],"how_to_check":"- unknown","fix":"- Update the Linux kernel to a release that includes the upstream fix validating queue count against initialized firmware slots (version unknown from sources)","status":"open","published_at":"2026-10-23T13:17:22+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:55:55+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T04:55:55Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream fix validating queue count against initialized firmware slots (version unknown from sources)","reach":"local","title":"Linux kernel Panthor GPU driver: unchecked queue count can crash the system","impact":"low","summary":"The Panthor DRM driver for Arm Mali GPUs accepts a userspace queue count up to a hardcoded maximum, even when the firmware initialized fewer stream interfaces. Requesting more queues than the firmware reported makes the kernel dereference an uninitialized interface and may crash.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","arm-mali","embedded","single-board-computer"],"confidence":0.5,"needs_auth":"unknown","worst_case":"local user crashes the kernel through a driver ioctl","analyst_note":"Check the NVD and kernel.org stable commits for affected version ranges, CVSS score, and the fixed kernel versions.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-panthor-driver"],"who_is_affected":"Systems running a Linux kernel with the Panthor driver, typically Arm Mali GPU hardware on devices such as some single-board computers and embedded boards. Systems without a Mali GPU using the Panthor driver are unlikely to be exposed. Whether unprivileged local users can reach the ioctl on a given system is not stated in the sources.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00062,"input_tokens":3504,"output_tokens":540,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-99003':15A,18A 'accept':39B 'arg':111C,113C 'arm':20B,36B 'arm-mali':19B 'base':182C 'board':29B 'comput':30B 'count':8A,43B,88C,93C,103C 'crash':10A,73B,175C 'creat':100C 'cs':116C,130C,161C,164C,178C 'csg':118C,132C,163C 'cve':13A,16A 'derefer':67B 'dereferenc':177C 'driver':5A,34B 'drm':33B 'drm/panthor':84C 'drv.c':96C 'einval':120C 'embed':22B 'even':49B 'fetch':168C 'fewer':54B,126C 'firmwar':52B,62B,91C,124C,154C 'follow':79C 'fw':134C 'gpu':4A 'gpus':38B 'group':99C 'hardcod':47B,108C 'howev':121C 'ifac':136C,179C 'init':135C 'initi':53B,90C,139C 'input':180C 'interfac':56B,70B,145C,172C 'ioctl':98C 'kernel':2A,25B,66B,77C 'linux':1A,24B,76C 'linux-kernel':23B 'lock':167C 'make':64B 'mali':21B,37B 'max':115C,129C,160C 'maximum':48B,109C 'may':72B,174C 'number':142C 'panthor':3A,32B,95C,97C,133C 'per':117C,131C,162C 'prog':166C 'queue':7A,42B,59B,87C,102C,151C 'queues.count':112C,114C 'report':63B,125C,155C 'request':57B,149C 'resolv':83C 'return':119C 'ringbuf':181C 'runtim':26B 'singl':28B 'single-board-comput':27B 'slot':92C,127C,165C 'smaller':141C 'stream':55B,144C,171C 'system':12A 'uncheck':6A 'uniniti':69B,170C 'unprivileg':147C 'userspac':41B,86C,148C 'valid':85C,105C 'vulner':80C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the Panthor driver, typically Arm Mali GPU hardware on devices such as some single-board computers and embedded boards. Systems without a Mali GPU using the Panthor driver are unlikely to be exposed. Whether unprivileged local users can reach the ioctl on a given system is not stated in the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:22+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99003","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99003","severity":null,"published_at":"2026-10-23T13:17:22+00:00","modified_at":"2026-10-23T13:17:22+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-99003","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-99003","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}