Cloudanix VulnDB

CVE-2026-99003

None

CVSS

—

EPSS

0.2%

Published

Oct 23, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux graphics driver can let a regular user on the machine crash the entire system by sending certain requests to the graphics hardware.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The driver validates userspace queue counts only against a hardcoded maximum instead of the firmware-reported slot count, allowing requests that fetch uninitialized stream interfaces and trigger a crash on dereference of cs_iface->input->ringbuf_base.

Why it matters to the business

Systems using the affected Linux kernel graphics driver can experience unexpected crashes or denial of service from local users, increasing operational downtime and support burden on recently released kernels.

How an attack unfolds

An unprivileged local user invokes the group-create ioctl with a queue count exceeding the firmware-initialized slots (yet within the hardcoded limit), causing cs_slot_prog_locked to access an uninitialized interface and panic the kernel.

How to fix it

Update to a kernel containing the validation fix that compares queue count against the actual firmware-reported slot count; rebuild and reboot affected systems.

How to confirm the fix worked

Confirm the kernel source contains the corrected check in panthor_ioctl_group_create that rejects counts larger than the firmware-reported value; test by attempting group creation with an out-of-range count and verifying -EINVAL is returned without crash.

Typical attack path

  1. Obtain unprivileged local access on a system with the panthor driver loaded
  2. Call panthor_ioctl_group_create with an args->queues.count value between the firmware slot count and MAX_CS_PER_CSG
  3. Trigger cs_slot_prog_locked to dereference the uninitialized cs_iface
  4. Cause kernel panic or crash

How to detect it

Review kernel logs for panthor-related oops or panic messages mentioning cs_slot_prog_locked, uninitialized stream interfaces, or ringbuf_base dereferences; correlate with recent ioctl activity on the DRM device.

What your security team should do

  • Prioritize kernel updates on all systems exposing the panthor driver within the next 7 days given the recent publication
  • Restrict unprivileged access to GPU device nodes via device permissions or SELinux policies until patched
  • Monitor vendor kernel update channels for the backported fix

The record

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: validate userspace queue count against initialized firmware slot count In panthor_drv.c:panthor_ioctl_group_create(), the queue count is validated against the hardcoded maximum: if (!args->queues.count || args->queues.count > MAX_CS_PER_CSG) return -EINVAL; However, if the firmware reports fewer slots than MAX_CS_PER_CSG, panthor_fw_init_ifaces() will only initialize that smaller number of stream interfaces. If unprivileged userspace requests more queues than the firmware reported (but no more than MAX_CS_PER_CSG), cs_slot_prog_locked() fetches an uninitialized stream interface and may crash when dereferencing cs_iface->input->ringbuf_base.

Affected packages

Ecosystem Package Introduced Fixed