CVE-2026-74451drm/panthor: validate firmware interface structure sizes
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: drm/panthor: validate firmware interface structure sizes iface_fw_to_cpu_addr() only checks that the firmware-provided MCU virtual address points inside the shared section. The returned pointer is later used as a full firmware interface structure, so accepting an address near the end of the shared section can still lead to out-of-bounds accesses. Pass the expected object size to iface_fw_to_cpu_addr() and reject ranges that do not fit entirely in the shared section.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 2718d91816eeed03c09c8abe872e45f59078768c builds before 21c77486f5a60bb9c0433c21de62a5f25d5091f1; from 2718d91816eeed03c09c8abe872e45f59078768c before c835f2b0b7167584832b516c9b0a26e9180d1d0b; from 2718d91816eeed03c09c8abe872e45f59078768c before ca41d9f3a21586bf29df53eec05152ecf2b2f94f; from 2718d91816eeed03c09c8abe872e45f59078768c before b921b8613790a3f9e78ab64017fa7149ef0b750c | CNA record |
References
- https://git.kernel.org/stable/c/21c77486f5a60bb9c0433c21de62a5f25d5091f1
- https://git.kernel.org/stable/c/c835f2b0b7167584832b516c9b0a26e9180d1d0b
- https://git.kernel.org/stable/c/ca41d9f3a21586bf29df53eec05152ecf2b2f94f
- https://git.kernel.org/stable/c/b921b8613790a3f9e78ab64017fa7149ef0b750c
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.