CVE-2026-90409: drm/panthor: Add vm_bind region with kbo range overlap check
In the Linux kernel, the following vulnerability has been resolved:
drm/panthor: Add vmbind region with kbo range overlap check
When a VM is created, caller has to specify the range of the address space carve-out set aside for mapping kernel BO's. That means vmbind mappings of UM-exposed BO's should not intersect with that region, but at the moment we're not checking this.
At first, I thought of giving these values to drmgpuvminit() through its reserve{offset, range} arguments, but it turns out that is meant for VM address spans that are not managed through the usual drmgpuvm split/merge circuit, so storing the end of the user VA range at VM creation time and doing a quick check in the vmbind ioctl path was the simplest workaround.
The new check also makes sure vmbind range doesn't overflow the size of a 64-bit unsigned integer. That was already being done further down the call stack inside drmgpuvmsmmap -> drmgpuvmrangevalid, but it's best to fail early in the driver before GPUVM functions are invoked so that we won't waste time allocating vmbind context resources.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel's drm/panthor driver are relevant. Exposure requires use of VM bind mappings for user-mode-exposed buffer objects in a VM with a kernel buffer-object address-space carve-out.
What condition is required to trigger the flaw?
A caller must submit a vm_bind mapping whose range intersects the address-space region reserved for mapping kernel buffer objects. The missing validation also allowed an oversized vm_bind range to reach later processing before overflow rejection.
What does the fix change?
The driver now records the end of the user virtual-address range when the VM is created and rejects vm_bind requests that overlap the kernel buffer-object region. It also rejects ranges that overflow a 64-bit unsigned integer before GPUVM resources are allocated.