CVE-2026-89825 in Linux
Summary
by MITRE • 09/16/2026
In the Linux kernel, the following vulnerability has been resolved:
drm/panthor: fix firmware control interface bounds checks
panthor_init_cs_iface() and panthor_init_csg_iface() validate firmware control interface offsets with 32-bit arithmetic and the size of the host wrapper structures. The offsets are derived from firmware-provided strides, so the arithmetic can wrap before the bounds check, and the host wrapper size is not the size of the firmware control interface being mapped.
Use 64-bit arithmetic for the computed offsets and validate against the actual firmware control interface structure sizes with subtraction-based bounds checks. Also validate that the shared section is large enough for the global control interface before using it.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The Linux kernel's DRM Panthor driver contained a critical integer overflow vulnerability within its initialization routines for command stream and command stream group interfaces, specifically in the functions panthor_init_cs_iface() and panthor_init_csg_iface(). This flaw stems from the use of 32-bit arithmetic to validate firmware control interface offsets. The offsets are derived directly from strides provided by the GPU firmware, which means that if these stride values are sufficiently large or maliciously crafted, the addition operations used to calculate memory boundaries can wrap around due to integer overflow before any bounds checking logic is executed. This classic integer overflow condition allows an attacker who controls the firmware interface data to bypass security checks designed to prevent out-of-bounds access.
Beyond the arithmetic error, there was a fundamental logical flaw in how the validation was performed relative to the actual memory structures involved. The original code validated offsets against the size of host wrapper structures rather than the true sizes of the firmware control interfaces being mapped into kernel space. This discrepancy creates a scenario where the calculated offset might appear valid when compared to the smaller host structure, yet actually point to an area outside the allocated region for the actual firmware interface data. Consequently, this misalignment between validation targets and target memory regions enables potential out-of-bounds reads or writes, which can lead to kernel memory corruption, privilege escalation, or system instability depending on how the invalid pointer is subsequently utilized by the driver stack.
The operational impact of this vulnerability is significant for systems utilizing ARM Mali GPUs managed through the Panthor driver. An attacker with access to user-space applications that interact with the DRM subsystem could potentially exploit these flawed bounds checks to read sensitive kernel memory or overwrite critical data structures within the kernel address space. This represents a severe security risk as it undermines the isolation between user-mode and kernel-mode execution environments, allowing for potential compromise of system integrity and confidentiality in multi-tenant cloud environments or on devices where local users might attempt privilege escalation attacks through GPU driver interfaces.
To mitigate this vulnerability, the fix implements several robust defensive programming practices aligned with industry standards such as CWE-190 (Integer Overflow or Wraparound) and CWE-787 (Out-of-bounds Write). The primary remediation involves replacing 32-bit arithmetic with 64-bit arithmetic for all computed offsets, thereby eliminating the possibility of wrap-around during offset calculation within typical memory constraints. Furthermore, the validation logic was corrected to perform subtraction-based bounds checks against the actual sizes of the firmware control interface structures rather than host wrapper proxies. This ensures that any calculated address remains strictly within the allocated buffer boundaries. Additionally, a new check was introduced to validate that the shared section is sufficiently large to accommodate the global control interface before it is accessed, preventing potential out-of-bounds access in scenarios where memory mapping sizes are insufficient. These changes align with ATT&CK techniques related to driver exploitation and kernel privilege escalation by closing the specific entry points used for invalid memory access through GPU command submission interfaces.