CVE-2026-74452

A flaw was found in the Linux kernel's drm/panthor component. This vulnerability allows a local attacker, by providing a specially crafted firmware, to cause a heap buffer overflow. This occurs because the data size to copy is not validated against the allocated section size, potentially leading to a massive out-of-bounds write in kernel memory. The most significant consequence is a denial of service, but it could potentially lead to further system compromise.

A moderate-severity heap buffer overflow was found in the Linux kernel's drm/panthor driver. In panthor_fw_load_section_entry(), the firmware section data size to copy is calculated as hdr.data.end - hdr.data.start without validating it against the allocated section size. A local attacker able to supply a specially crafted GPU firmware image could declare section data larger than the allocated memory, causing a heap buffer overflow in the memcpy() in panthor_fw_init_section_mem(); a data size exceeding the backing buffer object size could also underflow the subsequent memset() length, resulting in a massive out-of-bounds zeroing of kernel memory. The most significant consequence is a denial of service (kernel panic), although kernel memory corruption could potentially lead to further system compromise. Red Hat has rated this flaw MODERATE with a CVSS 3.1 score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), lower than the CVEORG score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), mainly reflecting the higher attack complexity: reliable exploitation requires carefully crafting the firmware image and control over the firmware loading path for the GPU driver. Based on the current affectedness records, Red Hat Enterprise Linux and Red Hat In-Vehicle OS are not affected by this flaw, as the tracked kernel, kernel-rt, and kernel-ivos-qualcomm components are marked NOTAFFECTED because the vulnerable code is not present in the shipped kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.