Executive brief
The Linux kernel's Panthor GPU driver improperly validates memory offsets when initializing firmware control interfaces, allowing integer overflow in the bounds check calculation. An attacker with local access to a system with a Panthor GPU could exploit this to access memory outside intended boundaries, potentially reading or modifying sensitive kernel data or triggering a denial of service.
Technical details
The vulnerability is an integer overflow and bounds check bypass in the Panthor GPU driver's firmware interface initialization code (panthor_init_cs_iface and panthor_init_csg_iface functions). The functions calculate firmware control interface offsets using 32-bit arithmetic with firmware-provided stride values, allowing the arithmetic to wrap before validation. Additionally, bounds checks compare against the size of host wrapper structures rather than the actual firmware control interface structures being mapped. An attacker with local access and the ability to interact with the GPU device could provide malicious stride values to trigger the overflow, potentially gaining out-of-bounds memory access. The fix converts offset calculations to 64-bit arithmetic and uses subtraction-based bounds checks against the correct structure sizes.
Affected products
- Linux Linux kernel multiple versions containing the Panthor GPU driver (drm/panthor)
Timeline
- 2026-09-16: disclosed
- 2026-07-20: patched: Patch commit 6a47f9fd2d970674ed9dedc52fc7ab76fd015785 developed; stable kernels updated 2026-09-11 and 2026-09-14