Linux Kernel EUVD-2026-80426

Requires the Panthor DRM driver (CONFIG_DRM_PANTHOR) active on a system with an ARM Mali CSF-based GPU, and the attacker must be able to influence the firmware image parsed by panthor_fw_read_build_info() - specifically the build-info header fields hdr.meta_start and hdr.meta_size (crafting an overflowing sum, or meta_size == 0, or metadata too short to hold the 'git_sha: ' prefix and trailing NULL). Loading a substituted firmware blob typically requires privileged/local access to the firmware search path, which is the main limiting factor; there is no remote or unauthenticated vector, and default vendor-signed firmware is not affected. Not exploitable on systems without Mali/Panthor hardware or with the driver unloaded.

Vendor CVSS 3.1 base score is 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H), i.e. a local, low-privileged vector with high confidentiality and availability impact. That scoring appears optimistic for a fix whose own commit message describes it as 'harden ... bounds checks': the attacker-controlled data (hdr.meta_start / hdr.meta_size, meta_size==0) originates from the Panthor/Mali firmware image (build-info metadata), not from an arbitrary syscall argument, so exploitation realistically presupposes the ability to supply or substitute a crafted firmware blob - a capability that on most systems already requires root/CAP_SYS_ADMIN to place the firmware file the kernel loads. That tension (PR:L in the vector versus firmware-substitution really implying higher privilege) should be verified against the actual load path. No EPSS score, no CISA KEV listing, and no public POC are provided; per the precision rules this is 'no public exploit identified at time of analysis.' Combined with the niche deployment footprint (ARM Mali CSF GPUs on specific SoCs, driver only present since 6.10), the real-world priority is LOW-to-MODERATE - a defensive robustness improvement rather than an actively-exploited threat. Treat the 7.1 as over-scored on privilege/complexity; the primary observable impact is an OOB read (potential info leak) and a GPU/driver crash (DoS), not remote code execution.

A local attacker who can influence the Panthor GPU firmware image supplies a build-info header whose meta_start + meta_size wraps past UINT32_MAX (or sets meta_size == 0), passing the original addition-based bounds check while pointing outside the firmware buffer. When panthor_fw_read_build_info() reads the 'git_sha: ' prefix and NULL terminator, it dereferences out-of-bounds kernel memory, disclosing adjacent data or crashing the driver/GPU. No public exploit code exists, and the attack requires local access plus control over the loaded firmware, limiting practicality.