Out-of-bounds read in Linux kernel - CVE-2026-74451

Vulnerability details

The vulnerability allows a local user to cause an out-of-bounds read or write.

The vulnerability exists due to improper bounds checking in iface_fw_to_cpu_addr() in the panthor firmware interface handling code when processing firmware-provided interface addresses. A local user can provide a crafted address near the end of the shared section to cause an out-of-bounds read or write.

Exploitation requires control over firmware-provided MCU virtual addresses used for interface structures.

Affected software

How to mitigate CVE-2026-74451

External References

• https://git.kernel.org/stable/c/21c77486f5a60bb9c0433c21de62a5f25d5091f1
• https://git.kernel.org/stable/c/b921b8613790a3f9e78ab64017fa7149ef0b750c
• https://git.kernel.org/stable/c/c835f2b0b7167584832b516c9b0a26e9180d1d0b
• https://git.kernel.org/stable/c/ca41d9f3a21586bf29df53eec05152ecf2b2f94f

Related Security Bulletins

• Out-of-bounds read in Linux kernel drm panthor driver
• Debian update for linux