CVE-2026-74452 drm/panthor: reject firmware sections with oversized data

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: reject firmware sections with oversized data In panthorfwloadsectionentry, the data size to copy is calculated without validating it against the allocated sectionsize: section-data.size = hdr.data.end - hdr.data.star...

CVE-2026-74452

The CVE-2026-74452 issue affects the Linux kernel DRM Panthor firmware loading. In panthor_fw_load_section_entry(), the copied data size is computed as hdr.data.end - hdr.data.start without validating against the allocated section_size, permitting a crafted firmware to set section->data.size l...

CVE-2026-74452 drm/panthor: reject firmware sections with oversized data

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: reject firmware sections with oversized data In panthorfwloadsectionentry, the data size to copy is calculated without validating it against the allocated sectionsize: section-data.size = hdr.data.end - hdr.data.star...

EUVD-2026-59645

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: reject firmware sections with oversized data In panthorfwloadsectionentry, the data size to copy is calculated without validating it against the allocated sectionsize: section-data.size = hdr.data.end - hdr.data.star...

CVE-2026-74452

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: reject firmware sections with oversized data In panthorfwloadsectionentry, the data size to copy is calculated without validating it against the allocated sectionsize: section-data.size = hdr.data.end - hdr.data.star...

CVE-2026-74451

CVE-2026-74451 affects the Linux kernel DRM panthor path. The root cause is that iface_fw_to_cpu_addr() only verified that the MCU virtual address lies within the shared section, but the returned pointer was used as a full firmware interface structure, allowing out-of-bounds accesses when the add...

CVE-2026-74451 drm/panthor: validate firmware interface structure sizes

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: validate firmware interface structure sizes ifacefwtocpuaddr only checks that the firmware-provided MCU virtual address points inside the shared section. The returned pointer is later used as a full firmware interfac...

EUVD-2026-59644

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: validate firmware interface structure sizes ifacefwtocpuaddr only checks that the firmware-provided MCU virtual address points inside the shared section. The returned pointer is later used as a full firmware interfac...

CVE-2026-74451 drm/panthor: validate firmware interface structure sizes

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: validate firmware interface structure sizes ifacefwtocpuaddr only checks that the firmware-provided MCU virtual address points inside the shared section. The returned pointer is later used as a full firmware interfac...

CVE-2026-74451

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: validate firmware interface structure sizes ifacefwtocpuaddr only checks that the firmware-provided MCU virtual address points inside the shared section. The returned pointer is later used as a full firmware interfac...

CVE-2026-72386

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Fix a leak when a group is evicted before the tiler OOM is serviced A group ref is tied to the pending tileroomwork, so we need to release it if the cancel was effective...

CVE-2026-72387

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Fix potential invalid pointer deref in groupprocesstileroom If heaps is an ERRPTR, panthorheappoolput will deref an invalid pointer. Make sure we set it to NULL in that case...

CVE-2026-72388

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Always use the IRQ-safe variant when acquiring the fence lock Since dmafence objects can be shared with other subsystems, they may be accessed from hardirq context in those drivers, and we have to take that into...

CVE-2026-72387

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Fix potential invalid pointer deref in groupprocesstileroom If heaps is an ERRPTR, panthorheappoolput will deref an invalid pointer. Make sure we set it to NULL in that case...

CVE-2026-72388

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Always use the IRQ-safe variant when acquiring the fence lock Since dmafence objects can be shared with other subsystems, they may be accessed from hardirq context in those drivers, and we have to take that into...

UBUNTU-CVE-2026-72387

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Fix potential invalid pointer deref in groupprocesstileroom If heaps is an ERRPTR, panthorheappoolput will deref an invalid pointer. Make sure we set it to NULL in that case...

UBUNTU-CVE-2026-72386

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Fix a leak when a group is evicted before the tiler OOM is serviced A group ref is tied to the pending tileroomwork, so we need to release it if the cancel was effective...

CVE-2026-72386

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Fix a leak when a group is evicted before the tiler OOM is serviced A group ref is tied to the pending tileroomwork, so we need to release it if the cancel was effective...

UBUNTU-CVE-2026-72388

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Always use the IRQ-safe variant when acquiring the fence lock Since dmafence objects can be shared with other subsystems, they may be accessed from hardirq context in those drivers, and we have to take that into...

CVE-2026-72387 drm/panthor: Fix potential invalid pointer deref in group_process_tiler_oom()

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Fix potential invalid pointer deref in groupprocesstileroom If heaps is an ERRPTR, panthorheappoolput will deref an invalid pointer. Make sure we set it to NULL in that case...