CVE-2026-90409
NoneCVSS
—
EPSS
0.2%
Published
Sep 17, 2026
CISA due date
—
Cloudanix analysis
A bug in the Linux graphics driver for certain GPUs could let a logged-in user tamper with protected system memory areas.
- Exploitation
- Local Privilege
- Attacker needs
- Low Privilege
- Complexity
- Moderate
- Impact
- Privilege Gain
- Component
- OS kernel
- Class
- Improper Input Validation
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Missing validation in the vm_bind ioctl path allows user-provided address ranges to overlap the kernel BO carve-out region or overflow a 64-bit unsigned integer, bypassing earlier drm_gpuvm checks.
Why it matters to the business
Local users on systems using the panthor driver could trigger invalid GPU address-space mappings, potentially leading to kernel memory interference, crashes, or privilege escalation with no external network access required.
How an attack unfolds
An attacker with local access crafts a vm_bind request that targets an address range overlapping the reserved kernel BO region; the absent early check lets the mapping proceed, after which GPU operations may access or corrupt kernel-managed memory.
How to fix it
Update the Linux kernel to a version containing the overlap and overflow checks in drm/panthor; rebuild and reboot systems using the panthor driver; apply vendor backports if available for the running kernel series.
How to confirm the fix worked
Confirm the patched kernel source contains the new range check before vm_bind proceeds and the early 64-bit overflow test; test that overlapping vm_bind calls now fail with an error before drm_gpuvm functions are reached.
Typical attack path
- Obtain local unprivileged shell on affected Linux system
- Identify or infer the KBO carve-out range for a panthor VM
- Issue vm_bind ioctl with overlapping or overflow address range
- Trigger GPU operations that exercise the invalid mapping
- Escalate via resulting kernel memory access or corruption
How to detect it
Review kernel logs for drm/panthor or drm_gpuvm errors around vm_bind calls; look for unexpected GPU faults or address-space warnings on systems running the affected driver; no widespread public exploitation artifacts are known.
What your security team should do
- Prioritize kernel updates on all systems exposing the panthor DRM driver
- Restrict unprivileged local access where feasible until patches are deployed
- Monitor for panthor-related kernel oops or GPU faults as potential exploitation signs
- Review downstream distribution advisories for backported fixes
The record
In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Add vm_bind region with kbo range overlap check When a VM is created, caller has to specify the range of the address space carve-out set aside for mapping kernel BO's. That means vm_bind mappings of UM-exposed BO's should not intersect with that region, but at the moment we're not checking this. At first, I thought of giving these values to drm_gpuvm_init() through its reserve_{offset, range} arguments, but it turns out that is meant for VM address spans that are not managed through the usual drm_gpuvm split/merge circuit, so storing the end of the user VA range at VM creation time and doing a quick check in the vm_bind ioctl path was the simplest workaround. The new check also makes sure vm_bind range doesn't overflow the size of a 64-bit unsigned integer. That was already being done further down the call stack inside drm_gpuvm_sm_map -> drm_gpuvm_range_valid, but it's best to fail early in the driver before GPUVM functions are invoked so that we won't waste time allocating vm_bind context resources.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|