{"id":"CVE-2026-99003","title":"drm/panthor: validate userspace queue count against initialized firmware slot count","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/panthor: validate userspace queue count against initialized firmware slot count\n\nIn panthor_drv.c:panthor_ioctl_group_create(),\nthe queue count is validated against…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= de85488138247d034eb3241840424a54d660926b < 4487cf79bf173f2b426a02d102076f8a20d23b96","Linux >= de85488138247d034eb3241840424a54d660926b < fdee3570b282a6c8699aea63fa5694355e010ec9","Linux >= de85488138247d034eb3241840424a54d660926b < 9be126be5f78bc331a930295af97c9b1f9158f06","Linux >= de85488138247d034eb3241840424a54d660926b < ec86c43dcfff68eab4db9bdafcd3e2b16e342e18","Linux 6.10"],"published":"2026-10-23","updated":"2026-10-23","sourceUpdated":"2026-10-23T12:20:24.476Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-99003","references":[{"url":"https://git.kernel.org/stable/c/4487cf79bf173f2b426a02d102076f8a20d23b96"},{"url":"https://git.kernel.org/stable/c/fdee3570b282a6c8699aea63fa5694355e010ec9"},{"url":"https://git.kernel.org/stable/c/9be126be5f78bc331a930295af97c9b1f9158f06"},{"url":"https://git.kernel.org/stable/c/ec86c43dcfff68eab4db9bdafcd3e2b16e342e18"}],"tags":["cve.org"],"ingestedAt":"2026-10-23T13:24:55.541Z","slug":"CVE-2026-99003","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/panthor: validate userspace queue count against initialized firmware slot count\n\nIn panthor_drv.c:panthor_ioctl_group_create(),\nthe queue count is validated against the hardcoded maximum:\n\n\tif (!args->queues.count || args->queues.count > MAX_CS_PER_CSG)\n\t\treturn -EINVAL;\n\nHowever, if the firmware reports fewer slots than MAX_CS_PER_CSG,\npanthor_fw_init_ifaces() will only initialize that smaller number of\nstream interfaces.\n\nIf unprivileged userspace requests more queues than the firmware reported\n(but no more than MAX_CS_PER_CSG), cs_slot_prog_locked() fetches an\nuninitialized stream interface and may crash when dereferencing\ncs_iface->input->ringbuf_base.\n\n## Affected\n\n- `Linux >= de85488138247d034eb3241840424a54d660926b < 4487cf79bf173f2b426a02d102076f8a20d23b96`\n- `Linux >= de85488138247d034eb3241840424a54d660926b < fdee3570b282a6c8699aea63fa5694355e010ec9`\n- `Linux >= de85488138247d034eb3241840424a54d660926b < 9be126be5f78bc331a930295af97c9b1f9158f06`\n- `Linux >= de85488138247d034eb3241840424a54d660926b < ec86c43dcfff68eab4db9bdafcd3e2b16e342e18`\n- `Linux 6.10`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}