CVE-2026-74452 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
drm/panthor: reject firmware sections with oversized data
In panthor_fw_load_section_entry(), the data size to copy is calculated without validating it against the allocated section_size:
section->data.size = hdr.data.end - hdr.data.start;
If a crafted firmware sets data.size larger than the allocated memory, this could cause a heap buffer overflow in panthor_fw_init_section_mem()
memcpy(section->mem->kmap, section->data.buf, section->data.size);
Additionally, if the section->data.size exceeds the BO size, could this memset underflow the size calculation, leading to a massive out-of-bounds zeroing of kernel memory?
memset(section->mem->kmap + section->data.size, 0, panthor_kernel_bo_size(section->mem) - section->data.size);
Reject section entries whose initial data is larger than the section size.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/16/2026
This vulnerability exists within the linux kernel's drm/panthor driver which handles firmware loading for graphics hardware components. The issue stems from inadequate validation of firmware section data sizes during the loading process, creating potential for both heap buffer overflow and memory corruption conditions. The flaw occurs in the panthor_fw_load_section_entry() function where the data size calculation does not properly validate against allocated memory boundaries.
The technical implementation error manifests when processing firmware headers where section->data.size is calculated as hdr.data.end - hdr.data.start without checking if this computed value exceeds the pre-allocated section_size. This allows maliciously crafted firmware to specify data sizes that surpass memory allocations, leading to heap buffer overflow conditions in the subsequent panthor_fw_init_section_mem() function. The memcpy operation copies data beyond allocated boundaries, potentially corrupting adjacent memory regions.
The vulnerability presents a significant operational risk as it could enable arbitrary code execution or system instability through kernel memory corruption. When section->data.size exceeds the BO (buffer object) size, additional dangerous conditions arise where memset operations may underflow their size calculations. This creates scenarios where massive out-of-bounds zeroing of kernel memory occurs, potentially affecting critical kernel structures and data integrity.
This vulnerability maps to CWE-121 heap-based buffer overflow and CWE-787 out-of-bounds write conditions within the context of kernel space memory management. The attack surface aligns with ATT&CK technique T1059.001 command and script interpreter execution through kernel-level privilege escalation pathways. The flaw represents a classic case of insufficient input validation in kernel drivers, where user-supplied firmware data is not properly sanitized before memory operations.
Mitigation strategies should include implementing strict bounds checking for all firmware section data sizes against allocated memory regions before any copying or zeroing operations occur. The driver should validate that section->data.size does not exceed section_size and panthor_kernel_bo_size(section->mem) constraints. Additionally, defensive programming measures such as explicit bounds checking in memcpy and memset operations can prevent the overflow and underflow conditions. System administrators should ensure kernel updates are applied promptly to address this vulnerability through proper firmware validation mechanisms that reject maliciously crafted sections before processing.