CVE-2026-80577: drm/panthor: skip zero-sized firmware sections
In the Linux kernel, the following vulnerability has been resolved:
drm/panthor: skip zero-sized firmware sections
panthorfwloadsectionentry() skips BO creation when the firmware section VA range is empty. If such a section is added to the firmware section list, section->mem is left as NULL.
Later reload and unplug paths iterate over all firmware sections and dereference section->mem, which can lead to a NULL pointer dereference.
Zero-sized firmware sections are valid, so accept them as no-op entries but skip adding them to the section list.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In drm/panthor, update panthor_fw_load_section_entry() to skip adding zero-sized firmware sections to the firmware section list, avoiding NULL dereference of section->mem on later reload/unplug paths.
Linux kernel drm/panthor panthor_fw_load_section_entry() behavior for firmware sections = Skip zero-sized firmware sections (do not add to firmware section list)
Event History
Frequently Asked Questions
What conditions are required to trigger the NULL pointer dereference?
The Panthor driver must load firmware containing a valid zero-sized section. The empty section can be recorded with its memory pointer left NULL, and a later firmware reload or device-unplug path can dereference that pointer.
What is the impact of this issue?
The affected reload or unplug path can trigger a NULL pointer dereference in the Linux kernel. The provided information does not establish any further impact beyond this kernel fault condition.
How is the issue addressed?
The fix treats zero-sized firmware sections as no-op entries and does not add them to the firmware section list. This prevents later iteration paths from encountering a section whose memory pointer is NULL.