SB20260816270 - Out-of-bounds read in Linux kernel drm panthor driver

Description

This security bulletin contains information about 1 vulnerability.

1) Out-of-bounds read (CVE-ID: CVE-2026-74451)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds read or write.

The vulnerability exists due to improper bounds checking in iface_fw_to_cpu_addr() in the panthor firmware interface handling code when processing firmware-provided interface addresses. A local user can provide a crafted address near the end of the shared section to cause an out-of-bounds read or write.

Exploitation requires control over firmware-provided MCU virtual addresses used for interface structures.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/21c77486f5a60bb9c0433c21de62a5f25d5091f1
• https://git.kernel.org/stable/c/b921b8613790a3f9e78ab64017fa7149ef0b750c
• https://git.kernel.org/stable/c/c835f2b0b7167584832b516c9b0a26e9180d1d0b
• https://git.kernel.org/stable/c/ca41d9f3a21586bf29df53eec05152ecf2b2f94f