Executive brief
The Linux kernel's DRM Panthor driver contains a null pointer dereference vulnerability in firmware section loading. When processing firmware with zero-sized sections, the driver fails to skip these sections, leaving memory pointers uninitialized. During device unplug or reload operations, dereferencing these null pointers causes a kernel crash, leading to denial of service on systems using Panthor graphics hardware.
Technical details
The vulnerability is a null pointer dereference in the panthor_fw_load_section_entry() function within drivers/gpu/drm/panthor/panthor_fw.c. The root cause is that when processing firmware sections with zero size, the function skips BO (buffer object) creation but still adds the section to the firmware section list with a NULL mem pointer. Later, during firmware reload and device unplug paths, the code iterates over all firmware sections and dereferences section->mem without null checks, triggering a kernel crash. The fix adds an early return when section_size is zero, preventing zero-sized sections from being added to the list. This is a local denial-of-service vulnerability requiring no network access or user interaction beyond loading affected firmware.
Affected products
- Linux Linux kernel Linux 5.0 through 6.x (all versions affected by commit 2718d91816ee)
Timeline
- 2026-08-26: disclosed
- 2026-07-30: patched: Upstream fix commit 2b8f13d3c7e26c46c20d9e367904cf01729c88e6