{"id":"CVE-2026-89825","revision":"fc9efdae2ef343269fb126420b6b2425","records":[{"revision":"fc9efdae2ef343269fb126420b6b2425","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-89825","aliases":[],"title":"drm/panthor: fix firmware control interface bounds checks","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/panthor: fix firmware control interface bounds checks\n\npanthor_init_cs_iface() and panthor_init_csg_iface() validate firmware\ncontrol interface offsets with 32-bit arithmetic and the size of the host\nwrapper structures. The offsets are derived from firmware-provided strides,\nso the arithmetic can wrap before the bounds check, and the host wrapper\nsize is not the size of the firmware control interface being mapped.\n\nUse 64-bit arithmetic for the computed offsets and validate against the\nactual firmware control interface structure sizes with subtraction-based\nbounds checks. Also validate that the shared section is large enough for\nthe global control interface before using it.","state":0,"publishedAt":"2026-09-16T10:30:57.497+00:00","modifiedAt":"2026-10-19T08:53:19.123+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/gpu/drm/panthor/panthor_fw.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"2718d91816eeed03c09c8abe872e45f59078768c\",\n                            \"lessThan\": \"33ae55809aee9b4dca1d00cdee35b527f2bf8626\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"2718d91816eeed03c09c8abe872e45f59078768c\",\n                            \"lessThan\": \"80c9528661c774f899281c9a72011208ff39929e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"2718d91816eeed03c09c8abe872e45f59078768c\",\n                            \"lessThan\": \"3e5c7cddc0073eef6f9bb373189b11a969f1f6f6\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"2718d91816eeed03c09c8abe872e45f59078768c\",\n                            \"lessThan\": \"6a47f9fd2d970674ed9dedc52fc7ab76fd015785\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/gpu/drm/panthor/panthor_fw.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.10\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.10\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.110\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.51\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.5\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/33ae55809aee9b4dca1d00cdee35b527f2bf8626","https://git.kernel.org/stable/c/80c9528661c774f899281c9a72011208ff39929e","https://git.kernel.org/stable/c/3e5c7cddc0073eef6f9bb373189b11a969f1f6f6","https://git.kernel.org/stable/c/6a47f9fd2d970674ed9dedc52fc7ab76fd015785"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89825","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-89825","identifiers":["CVE-2026-89825"]},"retained":false,"historicalAffected":[]}],"coverage":[]}