CVE-2026-89826drm/panthor: harden firmware build-info bounds checks
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: drm/panthor: harden firmware build-info bounds checks panthor_fw_read_build_info() checks whether the metadata range fits in the firmware image with hdr.meta_start + hdr.meta_size. Both fields are u32, so the addition can wrap and let an out-of-bounds range pass validation. The function also reads the "git_sha: " prefix without first checking that the metadata is long enough, and meta_size == 0 can underflow the NULL terminator index. Use subtraction-based bounds checking and reject metadata that is too short to contain the expected prefix and trailing NULL byte.
- CVSS
- 7.1 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 2718d91816eeed03c09c8abe872e45f59078768c before 5516f1acfd07564361cf306cc90a8e513df0f096; 2718d91816eeed03c09c8abe872e45f59078768c builds before 6ae19dce3e8c13ae73590b3f4311abe9f96bbae8; from 2718d91816eeed03c09c8abe872e45f59078768c before 8321b093fa6c297b80586460ce6914d9655df170 | CNA record |
References
- https://git.kernel.org/stable/c/5516f1acfd07564361cf306cc90a8e513df0f096
- https://git.kernel.org/stable/c/6ae19dce3e8c13ae73590b3f4311abe9f96bbae8
- https://git.kernel.org/stable/c/8321b093fa6c297b80586460ce6914d9655df170
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.