Executive brief
The Linux kernel's panthor GPU driver contains a bug in memory heap management during out-of-memory handling. If the heap pool initialization fails, the cleanup code attempts to dereference an invalid pointer, which could cause a kernel crash and temporary loss of GPU functionality.
Technical details
This is a use-after-free / invalid pointer dereference vulnerability in the panthor GPU scheduler (drivers/gpu/drm/panthor/panthor_sched.c). The group_process_tiler_oom() function fails to check if the heaps variable contains an error pointer (ERR_PTR) before passing it to panthor_heap_pool_put(), which then attempts to dereference the invalid pointer. The fix adds an explicit IS_ERR() check to set heaps to NULL when an error condition is detected, preventing the dereference. The vulnerability requires the heap pool allocation to fail, and the attack vector is limited to local denial-of-service through GPU workload manipulation. A patch was released upstream in June 2026 and is available in stable kernel versions.
Affected products
- Linux Linux kernel 5.0 and later (prior to patched versions)
Timeline
- 2026-08-15: disclosed
- 2026-06-25: patched: Upstream patch committed by Boris Brezillon