---
id: CVE-2026-99003
title: >-
  drm/panthor: validate userspace queue count against initialized firmware slot
  count
summary: >-
  In the Linux kernel, the following vulnerability has been resolved:


  drm/panthor: validate userspace queue count against initialized firmware slot
  count


  In panthor_drv.c:panthor_ioctl_group_create(),

  the queue count is validated against…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= de85488138247d034eb3241840424a54d660926b <
    4487cf79bf173f2b426a02d102076f8a20d23b96
  - >-
    Linux >= de85488138247d034eb3241840424a54d660926b <
    fdee3570b282a6c8699aea63fa5694355e010ec9
  - >-
    Linux >= de85488138247d034eb3241840424a54d660926b <
    9be126be5f78bc331a930295af97c9b1f9158f06
  - >-
    Linux >= de85488138247d034eb3241840424a54d660926b <
    ec86c43dcfff68eab4db9bdafcd3e2b16e342e18
  - Linux 6.10
published: '2026-10-23'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T12:20:24.476Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-99003'
references:
  - url: 'https://git.kernel.org/stable/c/4487cf79bf173f2b426a02d102076f8a20d23b96'
  - url: 'https://git.kernel.org/stable/c/fdee3570b282a6c8699aea63fa5694355e010ec9'
  - url: 'https://git.kernel.org/stable/c/9be126be5f78bc331a930295af97c9b1f9158f06'
  - url: 'https://git.kernel.org/stable/c/ec86c43dcfff68eab4db9bdafcd3e2b16e342e18'
tags:
  - cve.org
ingestedAt: '2026-10-23T13:24:55.541Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/panthor: validate userspace queue count against initialized firmware slot count

In panthor_drv.c:panthor_ioctl_group_create(),
the queue count is validated against the hardcoded maximum:

	if (!args->queues.count || args->queues.count > MAX_CS_PER_CSG)
		return -EINVAL;

However, if the firmware reports fewer slots than MAX_CS_PER_CSG,
panthor_fw_init_ifaces() will only initialize that smaller number of
stream interfaces.

If unprivileged userspace requests more queues than the firmware reported
(but no more than MAX_CS_PER_CSG), cs_slot_prog_locked() fetches an
uninitialized stream interface and may crash when dereferencing
cs_iface->input->ringbuf_base.

## Affected

- `Linux >= de85488138247d034eb3241840424a54d660926b < 4487cf79bf173f2b426a02d102076f8a20d23b96`
- `Linux >= de85488138247d034eb3241840424a54d660926b < fdee3570b282a6c8699aea63fa5694355e010ec9`
- `Linux >= de85488138247d034eb3241840424a54d660926b < 9be126be5f78bc331a930295af97c9b1f9158f06`
- `Linux >= de85488138247d034eb3241840424a54d660926b < ec86c43dcfff68eab4db9bdafcd3e2b16e342e18`
- `Linux 6.10`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.