Executive brief
The Linux kernel's DRM panthor GPU driver contains a NULL pointer dereference vulnerability that can be triggered when a graphics application partially unmaps memory from an evicted GPU buffer object. An attacker with local access to a machine running vulnerable kernel code could exploit this to crash the system or potentially execute arbitrary code with kernel privileges, disrupting normal operation and risking data corruption.
Technical details
The vulnerability is a NULL pointer dereference (NPD) in the panthor DRM driver's GPU memory mapping code. The root cause lies in the `iova_mapped_as_huge_page()` function which attempts to access the `bo->backing.pages` pointer during a partial unmap operation on an evicted buffer object. When a GPU buffer object (BO) is evicted, its backing pages are released and the pointer is set to NULL. However, the logic that handles huge page remapping during partial unmap was not properly skipped for evicted BOs, resulting in a dereference of NULL when the function tried to access the freed pages structure. The vulnerability is triggered through the `drm_gpuvm_sm_unmap` code path when user-space applications invoke the `panthor_ioctl_vm_bind` ioctl with specific unmap parameters. A fix has been committed that ensures the huge page remapping logic is properly skipped when handling evicted buffer objects.
Affected products
- Linux Linux kernel through 2026-09-17
Timeline
- 2026-09-17: disclosed: CVE-2026-93180 published
- 2026-09-17: patched: Fix committed to resolve NULL pointer dereference in panthor GPU driver