Executive brief
The Linux kernel's DRM Panthor graphics driver contains an integer overflow vulnerability in its firmware metadata validation code. An attacker with control over a malicious firmware image could bypass bounds checks and trigger out-of-bounds memory access, potentially leading to privilege escalation or denial of service on systems using ARM Mali GPUs.
Technical details
The vulnerability exists in panthor_fw_read_build_info() in drivers/gpu/drm/panthor/panthor_fw.c. The function validates whether a firmware metadata range fits within the firmware image using the check "hdr.meta_start + hdr.meta_size > fw->size". Since both hdr.meta_start and hdr.meta_size are u32 values, their addition can wrap around, allowing an out-of-bounds metadata range to pass validation. Additionally, the function reads the "git_sha: " prefix without first verifying the metadata buffer is long enough, and meta_size == 0 can cause underflow in NULL terminator index calculations. An attacker who can supply a crafted firmware file could exploit this to access memory beyond the firmware bounds. The fix uses subtraction-based bounds checking (hdr.meta_size > fw->size - hdr.meta_start) to prevent overflow and adds a minimum metadata size check.
Affected products
- Linux Linux kernel multiple versions (patch available as of 2026-07-20)
Timeline
- 2026-09-16: disclosed
- 2026-07-20: patched: Commit 8321b093fa6c297b80586460ce6914d9655df170 upstream