Executive brief
The Linux kernel's Panthor GPU driver did not properly validate that user-space virtual memory mappings do not overlap with kernel-reserved GPU memory regions. This validation gap could allow a compromised or malicious GPU application to corrupt kernel memory or cause GPU driver failures, potentially leading to system instability or data corruption.
Technical details
The vulnerability exists in the drm/panthor GPU driver's VM bind operation handler. When a virtual machine (VM) is created, callers must specify a reserved address-space region for kernel buffer objects (KBOs). However, the driver was not validating that user-space vm_bind requests do not intersect with this reserved kernel range. The fix adds an overlap check via the range_overflows() function in the panthor_vm_bind_prepare_op_ctx() path, returning -EINVAL if a mapping would overlap the kernel VA region. The check also catches 64-bit unsigned integer overflow conditions early, before lower-level GPUVM functions are invoked. This is a defensive validation fix with no known exploitation; it addresses latent logic gaps rather than a live attack vector.
Affected products
- Linux Linux kernel Affected versions include kernels from 4.x through 6.x and potentially earlier versions (fix applies upstream and to stable branches)
Timeline
- 2026-07-20: disclosed: Upstream commit authored
- 2026-07-29: patched: Merged into mainline
- 2026-09-17: advisory: CVE-2026-90409 published on NVD