Description

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: reject firmware sections with oversized data In panthor_fw_load_section_entry(), the data size to copy is calculated without validating it against the allocated section_size: section->data.size = hdr.data.end - hdr.data.start; If a crafted firmware sets data.size larger than the allocated memory, this could cause a heap buffer overflow in panthor_fw_init_section_mem() memcpy(section->mem->kmap, section->data.buf, section->data.size); Additionally, if the section->data.size exceeds the BO size, could this memset underflow the size calculation, leading to a massive out-of-bounds zeroing of kernel memory? memset(section->mem->kmap + section->data.size, 0, panthor_kernel_bo_size(section->mem) - section->data.size); Reject section entries whose initial data is larger than the section size.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-15T13:17:49.790Z",
  "pubdate": "2026-08-15T13:17:49.790Z",
  "executiveSummary": "A heap buffer overflow vulnerability exists in the Linux kernel drm/panthor driver component.\nThe vulnerability arises from insufficient bounds validation when processing firmware section entries during initialization.\nAn attacker capable of supplying a crafted firmware image can trigger a heap-based buffer overflow via unrestricted memory copying operations.\nThe primary impact of successful exploitation includes arbitrary kernel memory corruption, leading to potential system crashes, denial of service, or arbitrary code execution within the kernel context.\nThe affected system is the Linux kernel utilizing the panthor GPU driver.\nExploitation requires the ability to load a malicious or crafted firmware binary into the driver, implying local access or control over the firmware loading mechanism.",
  "technicalDetails": "The vulnerability is located in the panthor_fw_load_section_entry() function within the Linux kernel drm/panthor subsystem.\nThe root cause is the calculation of the section data size derived directly from firmware headers via the expression section->data.size = hdr.data.end - hdr.data.start without validating this calculated size against the actually allocated section_size.\nDuring the initialization phase in panthor_fw_init_section_mem(), a memory copy operation is executed using the unchecked size: memcpy(section->mem->kmap, section->data.buf, section->data.size).\nIf a crafted firmware specifies a data.size that exceeds the allocated memory size of the section, the memcpy operation results in a heap buffer overflow, corrupting adjacent kernel heap structures.\nAdditionally, subsequent memory zeroing operations utilize the oversized section->data.size within a memset calculation: memset(section->mem->kmap + section->data.size, 0, panthor_kernel_bo_size(section->mem) - section->data.size).\nThis calculation can induce an integer underflow depending on the buffer object (BO) size relative to the oversized section->data.size, potentially translating into massive out-of-bounds zeroing of adjacent kernel memory.\nThe attack flow proceeds as follows: 1) An attacker supplies or replaces a crafted firmware file intended for the panthor driver; 2) The driver parses the firmware headers in panthor_fw_load_section_entry(); 3) The unvalidated size header is accepted as section->data.size; 4) The driver allocates memory based on internal constraints while copying data of the oversized length; 5) Heap corruption is triggered via the oversized memcpy and subsequent underflowed memset operations.\nPrivilege and authentication requirements depend on the system's interface for loading GPU firmware, typically requiring local access with privileges capable of interacting with the Direct Rendering Manager (DRM) subsystem or triggering firmware reloads."
}