Vulnerability-Lookup

FKIE_CVE-2026-74451

Vulnerability from fkie_nvd - Published: 2026-08-15 13:17 - Updated: 2026-08-17 06:19

Severity

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: validate firmware interface structure sizes iface_fw_to_cpu_addr() only checks that the firmware-provided MCU virtual address points inside the shared section. The returned pointer is later used as a full firmware interface structure, so accepting an address near the end of the shared section can still lead to out-of-bounds accesses. Pass the expected object size to iface_fw_to_cpu_addr() and reject ranges that do not fit entirely in the shared section.

References

	URL	Tags
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/21c77486f5a60bb9c0433c21de62a5f25d5091f1
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/b921b8613790a3f9e78ab64017fa7149ef0b750c
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/c835f2b0b7167584832b516c9b0a26e9180d1d0b
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/ca41d9f3a21586bf29df53eec05152ecf2b2f94f

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/panthor/panthor_fw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "21c77486f5a60bb9c0433c21de62a5f25d5091f1",
              "status": "affected",
              "version": "2718d91816eeed03c09c8abe872e45f59078768c",
              "versionType": "git"
            },
            {
              "lessThan": "c835f2b0b7167584832b516c9b0a26e9180d1d0b",
              "status": "affected",
              "version": "2718d91816eeed03c09c8abe872e45f59078768c",
              "versionType": "git"
            },
            {
              "lessThan": "ca41d9f3a21586bf29df53eec05152ecf2b2f94f",
              "status": "affected",
              "version": "2718d91816eeed03c09c8abe872e45f59078768c",
              "versionType": "git"
            },
            {
              "lessThan": "b921b8613790a3f9e78ab64017fa7149ef0b750c",
              "status": "affected",
              "version": "2718d91816eeed03c09c8abe872e45f59078768c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/panthor/panthor_fw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/panthor: validate firmware interface structure sizes\n\niface_fw_to_cpu_addr() only checks that the firmware-provided MCU virtual\naddress points inside the shared section. The returned pointer is later\nused as a full firmware interface structure, so accepting an address near\nthe end of the shared section can still lead to out-of-bounds accesses.\n\nPass the expected object size to iface_fw_to_cpu_addr() and reject ranges\nthat do not fit entirely in the shared section."
    }
  ],
  "id": "CVE-2026-74451",
  "lastModified": "2026-08-17T06:19:40.953",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-08-15T13:17:49.697",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/21c77486f5a60bb9c0433c21de62a5f25d5091f1"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/b921b8613790a3f9e78ab64017fa7149ef0b750c"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/c835f2b0b7167584832b516c9b0a26e9180d1d0b"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/ca41d9f3a21586bf29df53eec05152ecf2b2f94f"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}

CVE-2026-74451 (GCVE-0-2026-74451)

Vulnerability from cvelistv5 – Published: 2026-08-15 12:26 – Updated: 2026-08-17 05:47

Title

drm/panthor: validate firmware interface structure sizes

Summary

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

4 references

URL	Tags
https://git.kernel.org/stable/c/21c77486f5a60bb9c…
https://git.kernel.org/stable/c/c835f2b0b71675848…
https://git.kernel.org/stable/c/ca41d9f3a21586bf2…
https://git.kernel.org/stable/c/b921b8613790a3f9e…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 2718d91816eeed03c09c8abe872e45f59078768c , < 21c77486f5a60bb9c0433c21de62a5f25d5091f1 (git) Affected: 2718d91816eeed03c09c8abe872e45f59078768c , < c835f2b0b7167584832b516c9b0a26e9180d1d0b (git) Affected: 2718d91816eeed03c09c8abe872e45f59078768c , < ca41d9f3a21586bf29df53eec05152ecf2b2f94f (git) Affected: 2718d91816eeed03c09c8abe872e45f59078768c , < b921b8613790a3f9e78ab64017fa7149ef0b750c (git)
Linux	Linux	Affected: 6.10 Unaffected: 0 , < 6.10 (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/panthor/panthor_fw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "21c77486f5a60bb9c0433c21de62a5f25d5091f1",
              "status": "affected",
              "version": "2718d91816eeed03c09c8abe872e45f59078768c",
              "versionType": "git"
            },
            {
              "lessThan": "c835f2b0b7167584832b516c9b0a26e9180d1d0b",
              "status": "affected",
              "version": "2718d91816eeed03c09c8abe872e45f59078768c",
              "versionType": "git"
            },
            {
              "lessThan": "ca41d9f3a21586bf29df53eec05152ecf2b2f94f",
              "status": "affected",
              "version": "2718d91816eeed03c09c8abe872e45f59078768c",
              "versionType": "git"
            },
            {
              "lessThan": "b921b8613790a3f9e78ab64017fa7149ef0b750c",
              "status": "affected",
              "version": "2718d91816eeed03c09c8abe872e45f59078768c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/panthor/panthor_fw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/panthor: validate firmware interface structure sizes\n\niface_fw_to_cpu_addr() only checks that the firmware-provided MCU virtual\naddress points inside the shared section. The returned pointer is later\nused as a full firmware interface structure, so accepting an address near\nthe end of the shared section can still lead to out-of-bounds accesses.\n\nPass the expected object size to iface_fw_to_cpu_addr() and reject ranges\nthat do not fit entirely in the shared section."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Out-of-bounds kernel accesses occur when panthor_fw_init_ifaces() accepts firmware MCU input_va/output_va at probe, then runtime DRM paths (GROUP_SUBMIT, scheduling, job IRQ handlers) dereference those cached interface pointers via /dev/dri/renderD* ioctls; no network or physical access is involved.\nAC:L - Once malicious or mis-layouted firmware publishes interface VAs near the shared-section end, iface_fw_to_cpu_addr() deterministically returns out-of-bounds pointers and every GPU submission or firmware event reliably performs the same OOB reads/writes without races or uncontrollable heap layout.\nPR:L - Planting a crafted mali_csffw.bin that makes the MCU publish bad interface VAs is feasible for local vendor/system accounts on Mali Android, Chromebook, and embedded firmware partitions; triggering the corruption afterward requires only standard render-node access (DRM_RENDER_ALLOW), not real init-namespace root.\nUI:N - After the bad interface pointers are established at driver probe or firmware boot, exploitation is driven entirely by the attacker\u0027s own GPU ioctl submissions and does not require any separate victim to open files, mount filesystems, or perform other interactive actions.\nS:U - The bug corrupts kernel heap memory adjacent to the firmware shared-section BO and can enable local privilege escalation within the host kernel, but it does not cross a VM, IOMMU, or sandbox boundary such as a KVM guest-to-host escape.\nC:H - Kernel code routinely READ_ONCEs large panthor_fw_*_output_iface structures (fault_info, status_wait_sync_ptr, heap metadata, etc.) through pointers that can extend hundreds of bytes past the shared BO, yielding out-of-bounds kernel memory disclosure rather than a bounded leak.\nI:H - Kernel code writes full panthor_fw_*_input_iface structures (ringbuf_base, heap_start/end, req/ack fields via panthor_fw_update_reqs) through the same undersized mappings, enabling out-of-bounds kernel writes exploitable for control-flow hijacking and local privilege escalation.\nA:H - Out-of-bounds reads and writes against the vmap of the firmware shared-section BO can immediately trigger kernel oopses or panics and remain reachable on every subsequent GPU job submission or firmware interrupt until the driver is reloaded."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:47:22.050Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/21c77486f5a60bb9c0433c21de62a5f25d5091f1"
        },
        {
          "url": "https://git.kernel.org/stable/c/c835f2b0b7167584832b516c9b0a26e9180d1d0b"
        },
        {
          "url": "https://git.kernel.org/stable/c/ca41d9f3a21586bf29df53eec05152ecf2b2f94f"
        },
        {
          "url": "https://git.kernel.org/stable/c/b921b8613790a3f9e78ab64017fa7149ef0b750c"
        }
      ],
      "title": "drm/panthor: validate firmware interface structure sizes",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74451",
    "datePublished": "2026-08-15T12:26:55.722Z",
    "dateReserved": "2026-08-15T05:44:03.899Z",
    "dateUpdated": "2026-08-17T05:47:22.050Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

FKIE_CVE-2026-74451

CVE-2026-74451 (GCVE-0-2026-74451)

Tags

Sightings

Nomenclature