CVE-2026-99003: drm/panthor: validate userspace queue count against initialized firmware slot count

In the Linux kernel, the following vulnerability has been resolved:

drm/panthor: validate userspace queue count against initialized firmware slot count

In panthordrv.c:panthorioctlgroupcreate(), the queue count is validated against the hardcoded maximum:

if (!args->queues.count || args->queues.count > MAXCSPERCSG) return -EINVAL;

However, if the firmware reports fewer slots than MAXCSPERCSG, panthorfwinitifaces() will only initialize that smaller number of stream interfaces.

If unprivileged userspace requests more queues than the firmware reported (but no more than MAXCSPERCSG), csslotproglocked() fetches an uninitialized stream interface and may crash when dereferencing csiface->input->ringbufbase.