Description

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: validate firmware interface structure sizes iface_fw_to_cpu_addr() only checks that the firmware-provided MCU virtual address points inside the shared section. The returned pointer is later used as a full firmware interface structure, so accepting an address near the end of the shared section can still lead to out-of-bounds accesses. Pass the expected object size to iface_fw_to_cpu_addr() and reject ranges that do not fit entirely in the shared section.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-15T13:17:49.697Z",
  "pubdate": "2026-08-15T13:17:49.697Z",
  "executiveSummary": "A vulnerability has been identified in the Linux kernel drm/panthor driver concerning the validation of firmware interface structure sizes. The flaw exists due to insufficient boundary checks within the iface_fw_to_cpu_addr() function when translating firmware-provided MCU virtual addresses to CPU addresses. Specifically, the function previously verified only that the base address pointed within the designated shared section, failing to account for the actual size of the structure mapped to that address. This oversight allows an attacker to supply a crafted address near the end of the shared section, causing subsequent operations to read or write past the boundary of the allocated region. The impact of this vulnerability includes potential out-of-bounds memory access, leading to kernel memory corruption, system instability, or potential privilege escalation depending on the attacker's capability to manipulate firmware interfaces. Affected systems are those running the Linux kernel with the panthor DRM driver enabled. Exploitation typically requires local access and the ability to interact with the DRM device file interface to submit malicious firmware commands or parameters.",
  "technicalDetails": "The vulnerability resides in the drm/panthor driver of the Linux kernel, specifically within the address translation logic implemented by the iface_fw_to_cpu_addr() function. The vulnerable component is responsible for mapping firmware-provided microcontroller (MCU) virtual addresses into CPU-accessible virtual addresses within a shared memory section. The root cause of the vulnerability is an incomplete bounds-checking validation mechanism. Previously, iface_fw_to_cpu_addr() performed a validation check ensuring solely that the starting MCU virtual address fell within the boundaries of the shared section. However, the pointer returned by this translation routine is subsequently dereferenced and utilized as a full firmware interface structure of a specific size. Because the check omitted the size of the expected data structure, an attacker or compromised firmware could supply a base address positioned near the very end of the shared section. While the base address technically satisfies the initial validation check, the full size of the expected structure exceeds the remaining bounds of the shared section. Consequently, any read or write operations targeting members of the structure result in out-of-bounds memory accesses. The attack flow begins with the interaction with the panthor DRM driver, where an adversary or malicious firmware interface provides manipulated address offsets. During execution, the driver calls iface_fw_to_cpu_addr(), which returns a pointer without enforcing that the entire object fits within the valid memory region. Subsequent access to the structure fields triggers the out-of-bounds memory read or write. This can lead to undefined behavior, kernel panics due to page faults, or corruption of adjacent kernel memory structures. Exploitation of this vulnerability requires local execution privileges to interact with the panthor device nodes exposed by the DRM subsystem. There are no direct network exposure vectors unless combined with a separate vulnerability that grants arbitrary local code execution or direct device access."
}