EUVD-2026-80425
GHSA-rf43-g6fv-p7qg
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local panthor driver reach (AV:L/PR:L); AC:H because the overflow must be driven through firmware-controlled strides rather than direct input; kernel memory corruption gives C:H/I:H/A:H.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
7DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
drm/panthor: fix firmware control interface bounds checks
panthor_init_cs_iface() and panthor_init_csg_iface() validate firmware control interface offsets with 32-bit arithmetic and the size of the host wrapper structures. The offsets are derived from firmware-provided strides, so the arithmetic can wrap before the bounds check, and the host wrapper size is not the size of the firmware control interface being mapped.
Use 64-bit arithmetic for the computed offsets and validate against the actual firmware control interface structure sizes with subtraction-based bounds checks. Also validate that the shared section is large enough for the global control interface before using it.
AnalysisAI
Out-of-bounds memory access in the Linux kernel's drm/panthor driver for Arm Mali CSF-class GPUs, caused by 32-bit offset arithmetic wrapping before a bounds check in panthor_init_cs_iface() and panthor_init_csg_iface(). A local attacker with low privileges on a system that has CONFIG_DRM_PANTHOR loaded and a Mali CSF GPU present could influence firmware-provided control-interface strides/offsets to escape the mapped region, yielding potential information disclosure and memory corruption (high confidentiality, integrity, and availability impact per the assessed vector). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the CONFIG_DRM_PANTHOR driver loaded and an Arm Mali CSF-class GPU present, plus local low-privileged access to the driver. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a memory-safety hardening fix in the drm/panthor kernel driver (Arm Mali CSF GPUs), not a demonstrated exploitation priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patches are available: upgrade to Linux 6.12.110, 6.18.51, 7.2.5, or 7.3-rc1 (or a later release containing the fix), or apply the corresponding stable backports 33ae55809aee9b4dca1d00cdee35b527f2bf8626, 80c9528661c774f899281c9a72011208ff39929e, 3e5c7cddc0073eef6f9bb373189b11a969f1f6f6, and 6a47f9fd2d970674ed9dedc52fc7ab76fd015785 from git.kernel.org/stable; the upstream advisory is linked via https://nvd.nist.gov/vuln/detail/CVE-2026-89825. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all systems with the Linux kernel drm/panthor driver enabled (CONFIG_DRM_PANTHOR) and Arm Mali CSF-class GPUs; restrict local access to trusted users until patched. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today