CVE-2026-90409 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
drm/panthor: Add vm_bind region with kbo range overlap check
When a VM is created, caller has to specify the range of the address space carve-out set aside for mapping kernel BO's. That means vm_bind mappings of UM-exposed BO's should not intersect with that region, but at the moment we're not checking this.
At first, I thought of giving these values to drm_gpuvm_init() through its reserve_{offset, range} arguments, but it turns out that is meant for VM
address spans that are not managed through the usual drm_gpuvm split/merge circuit, so storing the end of the user VA range at VM creation time and doing a quick check in the vm_bind ioctl path was the simplest workaround.
The new check also makes sure vm_bind range doesn't overflow the size of a 64-bit unsigned integer. That was already being done further down the call stack inside drm_gpuvm_sm_map -> drm_gpuvm_range_valid, but it's best to fail early in the driver before GPUVM functions are invoked so that we won't waste time allocating vm_bind context resources.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/17/2026
The Linux kernel’s DRM Panthor graphics driver contained a logic flaw related to virtual memory address space management during buffer object mapping operations. Specifically, when creating a new virtual machine instance for the GPU, the system reserves a specific range of addresses intended exclusively for kernel-backed objects. This reservation is critical to prevent conflicts between user-space exposed buffers and internal kernel resources. However, prior to this fix, the driver failed to validate that mappings created via the vm_bind ioctl did not intersect with this reserved kernel address space region. This oversight allowed potentially malicious or erroneous user-space applications to map their buffer objects into memory regions designated for kernel use, thereby bypassing intended isolation boundaries within the GPU’s virtual memory subsystem.
This vulnerability represents a failure in access control and input validation mechanisms within the graphics driver stack. By allowing vm_bind operations to overlap with reserved kernel ranges, an attacker could potentially achieve unauthorized read or write access to kernel-managed data structures residing in those address spaces. Such an action can lead to information disclosure if sensitive kernel memory is leaked through GPU mappings, or more critically, privilege escalation if the mapped region contains executable code or critical control structures that can be modified. The flaw aligns with CWE-20 Improper Input Validation and CWE-787 Out-of-bounds Write in contexts where boundary checks are omitted, allowing operations to encroach upon protected memory zones.
The operational impact of this vulnerability extends beyond simple data corruption. Because the Panthor driver handles GPU command submission and buffer management, an exploit could allow a local user to interfere with other processes or kernel subsystems that rely on the integrity of the reserved address space. This undermines the fundamental security model of virtualization within the graphics stack, where isolation between user-space applications and the host operating system is paramount. Furthermore, without this check, the driver might proceed to allocate resources for invalid mappings, wasting computational overhead before eventually failing at deeper layers in the call stack, which reduces efficiency and provides a larger attack surface for denial-of-service conditions through resource exhaustion.
To mitigate this risk, the fix implements an explicit validation step within the vm_bind ioctl path that checks whether the requested user-space buffer object range overlaps with the pre-reserved kernel address space region. Additionally, the patch introduces an early check to ensure that the calculated end of the mapping does not overflow a 64-bit unsigned integer limit. This dual-layer defense ensures that invalid mappings are rejected immediately at the driver level before any significant resources are allocated or complex GPU virtual memory management functions like drm_gpuvm_sm_map are invoked. By failing fast, the system prevents both security violations and unnecessary computational waste associated with processing malformed requests deep within the kernel’s graphics subsystem.
From a threat modeling perspective, this vulnerability is relevant to ATT&CK techniques involving local privilege escalation and defense evasion through driver exploitation. Attackers targeting Linux-based systems often look for such gaps in hardware abstraction layers where memory safety guarantees are not strictly enforced by the compiler or runtime environment. The resolution reinforces the principle of least privilege by ensuring that user-space applications cannot map into kernel-reserved regions, thereby maintaining strict separation between user and kernel address spaces. This aligns with industry best practices for secure driver development, emphasizing rigorous validation of all input parameters related to memory addresses before committing system resources.