CVE-2026-74451

A flaw was found in the drm/panthor component of the Linux kernel. The iface_fw_to_cpu_addr() function, responsible for validating firmware interface structure sizes, does not adequately check if the firmware-provided Microcontroller Unit (MCU) virtual address fits entirely within the shared memory section. This oversight allows an address near the end of the shared section to be accepted, potentially leading to out-of-bounds memory accesses. Such accesses could result in system instability or information disclosure.

The panthor firmware interface code validated only that a firmware provided MCU virtual address started inside the shared section. If the address points near the end of that section, the returned CPU pointer can still be used as a full interface structure and later field accesses may go out-of-bounds. This is a local GPU driver issue and is not network reachable. For the CVSS the PR:L is used for the paranoid score because some deployments may expose GPU render nodes or firmware mediated GPU control to non root local users, even though reliable control of the firmware interface is not proven. Impact is at least denial of service via invalid kernel memory access and in worst case may allow confidentiality or integrity impact because the bug class is out-of-bounds access in kernel memory.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.