Linux Kernel EUVD-2026-59644

Exploitation requires: (1) local authenticated access with at least low-privilege user permissions on the target system (PR:L per CVSS); (2) the target system must be equipped with an ARM Mali Valhall-generation GPU and must have the drm/panthor kernel module loaded and active - this is a hardware-specific prerequisite not met by x86 servers, standard cloud VMs, or systems with non-Valhall GPUs; (3) the attacker must be able to reach the firmware interface interaction path within the driver, which depends on access to DRM device nodes. Exploitation is NOT limited to any special software configuration beyond the hardware requirement - once local access and the correct hardware are present, no further non-default configuration is needed. Limiting factors: the drm/panthor driver is absent on the vast majority of Linux deployments (x86/x64 servers, AMD GPU systems, NVIDIA GPU systems); the attack is local-only with no network vector.

The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a local privilege escalation scenario: an attacker with low-privilege local access on an affected system could potentially achieve full kernel memory read/write, translating to complete host compromise. However, real-world risk is substantially moderated by three factors. First, exploitation requires the drm/panthor driver to be loaded, which only occurs on systems with specific ARM Mali Valhall GPUs - a hardware constraint that limits the affected population primarily to ARM-based embedded devices, certain Chromebooks, and developer boards, rather than mainstream servers or workstations. Second, EPSS is 0.17% at the 6th percentile, confirming no known exploitation activity or public weaponization. Third, no CVE KEV listing and no public POC exist. The CVSS vector signals low complexity once local access is achieved, meaning exploitation is mechanically straightforward for a skilled attacker who has local foothold on affected hardware - but reaching that foothold in the first place is the real barrier. This is a genuine patch-and-move-on priority for affected hardware operators, not a critical emergency.

A local user with a shell on an ARM-based device running an affected Linux kernel (e.g., a developer board or Chromebook with Mali Valhall GPU) crafts a firmware-side MCU virtual address that points near the very end of the GPU's shared firmware memory section. When the kernel's drm/panthor driver passes this address to iface_fw_to_cpu_addr() and then dereferences the returned pointer as a full firmware interface structure, memory reads and writes extend past the shared section boundary into adjacent kernel memory. The attacker leverages this out-of-bounds kernel memory access to read sensitive data or corrupt kernel structures, ultimately escalating to root. No public POC exists, making this currently a theoretical-but-mechanically-viable attack for skilled kernel exploit developers on target hardware.