CVE-2026-89826: drm/panthor: harden firmware build-info bounds checks
In the Linux kernel, the following vulnerability has been resolved:
drm/panthor: harden firmware build-info bounds checks
panthorfwreadbuildinfo() checks whether the metadata range fits in the firmware image with hdr.metastart + hdr.metasize. Both fields are u32, so the addition can wrap and let an out-of-bounds range pass validation.
The function also reads the "gitsha: " prefix without first checking that the metadata is long enough, and metasize == 0 can underflow the NULL terminator index.
Use subtraction-based bounds checking and reject metadata that is too short to contain the expected prefix and trailing NULL byte.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger the vulnerable parsing path?
The issue is reached when panthor_fw_read_build_info() processes firmware build metadata. A malformed firmware image can use a metadata start and size whose 32-bit sum wraps, or provide metadata that is too short for the expected "git_sha: " prefix and trailing NULL byte.
How can I determine whether a firmware image is malformed in the affected ways?
Check whether meta_start plus meta_size would exceed the firmware image bounds when calculated without 32-bit overflow. Also reject metadata shorter than the expected "git_sha: " prefix plus a trailing NULL byte, including metadata with a size of zero.
What mitigation is available if the kernel update cannot be applied immediately?
Avoid loading or processing untrusted firmware images with malformed build metadata. Validate metadata ranges using subtraction-based bounds checks and require sufficient metadata length before reading the prefix or indexing a terminating NULL byte.