SB20261023166 - Access of Uninitialized Pointer in Linux kernel drm panthor driver

Description

This security bulletin contains information about 1 vulnerability.

1) Access of Uninitialized Pointer (CVE-ID: CVE-2026-99003)

CWE-ID: CWE-824 - Access of Uninitialized Pointer

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by crashing the kernel.

The vulnerability exists due to insufficient queue-count validation leading to an uninitialized pointer dereference in the Linux kernel Panthor driver when creating queue groups. A local user can request more queues than the firmware-reported stream slot count, without exceeding MAX_CS_PER_CSG, to cause cs_slot_prog_locked() to access an uninitialized stream interface and potentially crash the kernel when dereferencing cs_iface->input->ringbuf_base.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/4487cf79bf173f2b426a02d102076f8a20d23b96
• https://git.kernel.org/stable/c/9be126be5f78bc331a930295af97c9b1f9158f06
• https://git.kernel.org/stable/c/ec86c43dcfff68eab4db9bdafcd3e2b16e342e18
• https://git.kernel.org/stable/c/fdee3570b282a6c8699aea63fa5694355e010ec9