EUVD-2026-80426
GHSA-vfmm-vgxh-2c77
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Exploitation needs local privileged control over the loaded firmware image (PR:H) and a crafted overflow condition (AC:H); realistic impact is limited OOB read (C:L) and driver/GPU crash (A:L).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
drm/panthor: harden firmware build-info bounds checks
panthor_fw_read_build_info() checks whether the metadata range fits in the firmware image with hdr.meta_start + hdr.meta_size. Both fields are u32, so the addition can wrap and let an out-of-bounds range pass validation.
The function also reads the "git_sha: " prefix without first checking that the metadata is long enough, and meta_size == 0 can underflow the NULL terminator index.
Use subtraction-based bounds checking and reject metadata that is too short to contain the expected prefix and trailing NULL byte.
AnalysisAI
The Linux kernel's Panthor DRM driver for ARM Mali CSF-based GPUs (Mali-G310/G510/G610/G710/G720 class hardware) fails to safely validate the build-info metadata block it parses out of the loaded firmware image: panthor_fw_read_build_info() adds the u32 header fields hdr.meta_start and hdr.meta_size without overflow protection, reads the "git_sha: " prefix without first confirming the metadata is long enough, and can underflow the trailing NULL terminator index when meta_size is zero. An attacker who can supply or influence the firmware blob can therefore make malformed metadata pass validation and drive out-of-bounds reads, yielding information disclosure and potential availability impact on the GPU/driver. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the Panthor DRM driver (CONFIG_DRM_PANTHOR) active on a system with an ARM Mali CSF-based GPU, and the attacker must be able to influence the firmware image parsed by panthor_fw_read_build_info() - specifically the build-info header fields hdr.meta_start and hdr.meta_size (crafting an overflowing sum, or meta_size == 0, or metadata too short to hold the 'git_sha: ' prefix and trailing NULL). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Vendor CVSS 3.1 base score is 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H), i.e. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: Linux 6.18.51, 7.2.5 and 7.3-rc1 (stable commits 5516f1acfd07564361cf306cc90a8e513df0f096, 6ae19dce3e8c13ae73590b3f4311abe9f96bbae8 and 8321b093fa6c297b80586460ce6914d9655df170 at https://git.kernel.org/stable/c/5516f1acfd07564361cf306cc90a8e513df0f096 and the two sibling commit URLs) - upgrade to the patched kernel for each maintained branch listed in the advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-89826. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory Linux systems with ARM Mali CSF GPUs where the Panthor DRM driver is active, confirm kernel versions, and identify any non-default or externally influenceable firmware loading paths. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today