Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2026-74451

drm/panthor: validate firmware interface structure sizes

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: validate firmware interface structure sizes iface_fw_to_cpu_addr() only checks that the firmware-provided MCU virtual address points inside the shared section. The returned pointer is later used as a full firmware interface structure, so accepting an address near the end of the shared section can still lead to out-of-bounds accesses. Pass the expected object size to iface_fw_to_cpu_addr() and reject ranges that do not fit entirely in the shared section.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 2718d91816eeed03c09c8abe872e45f59078768c to < 21c77486f5a60bb9c0433c21de62a5f25d5091f1affected
  • 2718d91816eeed03c09c8abe872e45f59078768c to < c835f2b0b7167584832b516c9b0a26e9180d1d0baffected
  • 2718d91816eeed03c09c8abe872e45f59078768c to < ca41d9f3a21586bf29df53eec05152ecf2b2f94faffected
  • 2718d91816eeed03c09c8abe872e45f59078768c to < b921b8613790a3f9e78ab64017fa7149ef0b750caffected

Linux Linux

Default version status: affected

  • 6.10affected
  • 0 to < 6.10unaffected
  • 6.12.103 to ≤ 6.12.*unaffected
  • 6.18.44 to ≤ 6.18.*unaffected
  • 7.1.8 to ≤ 7.1.*unaffected
  • 7.2 to ≤ *unaffected

References