Linux Kernel CVE-2026-74452

Exploitation requires a Linux system running a kernel version from commit 2718d91816eeed03c09c8abe872e45f59078768c onward that is physically or logically equipped with an Arm Mali Valhall (Panthor-family) GPU and has the drm/panthor module loaded. The attacker must be able to supply or substitute a crafted firmware file in a path searched by the panthor driver (typically under /lib/firmware); on standard Linux distributions, write access to that directory requires root or CAP_SYS_ADMIN, meaning the effective required privilege is likely higher than the CVSS PR:L rating implies for hardened deployments. Triggering firmware reload - the event that activates the vulnerable parse path - typically requires the ability to unbind/rebind the device or reload the kernel module, which itself may require elevated privilege. Limiting factors include: specific Arm Mali Valhall GPU hardware must be present; the drm/panthor module must be in use; and write access to the firmware directory must be accessible to the attacker. Systems using x86, x86-64, or other GPU hardware are entirely unaffected.

The NVD CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.8) scores this as a local, low-complexity attack requiring only low privileges with maximum impact, which is plausible for the worst-case path but may overestimate accessibility: placing a crafted firmware image in /lib/firmware typically requires root or equivalent write access on a standard hardened Linux deployment, suggesting the effective PR may be higher than PR:L in most real configurations. EPSS at 0.18% and 8th-percentile rank indicates the broader security community has not observed or anticipates widespread exploitation, and the absence of a CISA KEV entry confirms no active exploitation has been reported. The local attack vector and hardware prerequisite (Arm Mali Valhall GPU) substantially limit the population of reachable targets - even a mid-sized municipal IT team in gliwice running standard x86-64 server infrastructure would be entirely unaffected unless they operate ARM-based systems with Panthor-class GPU hardware. For environments that do include such hardware (embedded platforms, ARM servers, developer workstations), the risk is real: a heap overflow with an attacker-controlled length and a potential memset underflow producing kernel-wide memory corruption are primitives frequently chained into privilege escalation. No public proof-of-concept has been identified, which reduces near-term practical risk further, but the technical severity on vulnerable hardware is high.

A local attacker with low-privilege access on a Linux system equipped with an Arm Mali Valhall GPU writes a crafted firmware image - containing a header where data.end minus data.start exceeds the allocated section_size - into the firmware search path, then triggers panthor DRM driver firmware loading by unbinding and rebinding the GPU device or reloading the panthor module. The driver's panthor_fw_load_section_entry() computes the oversized data.size without validation, which is subsequently passed to memcpy in panthor_fw_init_section_mem(), overflowing the heap buffer and corrupting adjacent kernel memory structures; if data.size also exceeds the BO size, the memset length underflows to a near-maximal value, zeroing gigabytes of kernel memory and causing a system crash or enabling further exploitation. No public proof-of-concept exploit has been identified at time of analysis.