CVE-2026-74451

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74451", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.899Z", "datePublished": "2026-08-15T12:26:55.722Z", "dateUpdated": "2026-08-17T05:47:22.050Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:47:22.050Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/panthor: validate firmware interface structure sizes\n\niface_fw_to_cpu_addr() only checks that the firmware-provided MCU virtual\naddress points inside the shared section. The returned pointer is later\nused as a full firmware interface structure, so accepting an address near\nthe end of the shared section can still lead to out-of-bounds accesses.\n\nPass the expected object size to iface_fw_to_cpu_addr() and reject ranges\nthat do not fit entirely in the shared section."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - Out-of-bounds kernel accesses occur when panthor_fw_init_ifaces() accepts firmware MCU input_va/output_va at probe, then runtime DRM paths (GROUP_SUBMIT, scheduling, job IRQ handlers) dereference those cached interface pointers via /dev/dri/renderD* ioctls; no network or physical access is involved.\nAC:L - Once malicious or mis-layouted firmware publishes interface VAs near the shared-section end, iface_fw_to_cpu_addr() deterministically returns out-of-bounds pointers and every GPU submission or firmware event reliably performs the same OOB reads/writes without races or uncontrollable heap layout.\nPR:L - Planting a crafted mali_csffw.bin that makes the MCU publish bad interface VAs is feasible for local vendor/system accounts on Mali Android, Chromebook, and embedded firmware partitions; triggering the corruption afterward requires only standard render-node access (DRM_RENDER_ALLOW), not real init-namespace root.\nUI:N - After the bad interface pointers are established at driver probe or firmware boot, exploitation is driven entirely by the attacker's own GPU ioctl submissions and does not require any separate victim to open files, mount filesystems, or perform other interactive actions.\nS:U - The bug corrupts kernel heap memory adjacent to the firmware shared-section BO and can enable local privilege escalation within the host kernel, but it does not cross a VM, IOMMU, or sandbox boundary such as a KVM guest-to-host escape.\nC:H - Kernel code routinely READ_ONCEs large panthor_fw_*_output_iface structures (fault_info, status_wait_sync_ptr, heap metadata, etc.) through pointers that can extend hundreds of bytes past the shared BO, yielding out-of-bounds kernel memory disclosure rather than a bounded leak.\nI:H - Kernel code writes full panthor_fw_*_input_iface structures (ringbuf_base, heap_start/end, req/ack fields via panthor_fw_update_reqs) through the same undersized mappings, enabling out-of-bounds kernel writes exploitable for control-flow hijacking and local privilege escalation.\nA:H - Out-of-bounds reads and writes against the vmap of the firmware shared-section BO can immediately trigger kernel oopses or panics and remain reachable on every subsequent GPU job submission or firmware interrupt until the driver is reloaded."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/panthor/panthor_fw.c"], "versions": [{"version": "2718d91816eeed03c09c8abe872e45f59078768c", "lessThan": "21c77486f5a60bb9c0433c21de62a5f25d5091f1", "status": "affected", "versionType": "git"}, {"version": "2718d91816eeed03c09c8abe872e45f59078768c", "lessThan": "c835f2b0b7167584832b516c9b0a26e9180d1d0b", "status": "affected", "versionType": "git"}, {"version": "2718d91816eeed03c09c8abe872e45f59078768c", "lessThan": "ca41d9f3a21586bf29df53eec05152ecf2b2f94f", "status": "affected", "versionType": "git"}, {"version": "2718d91816eeed03c09c8abe872e45f59078768c", "lessThan": "b921b8613790a3f9e78ab64017fa7149ef0b750c", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/panthor/panthor_fw.c"], "versions": [{"version": "6.10", "status": "affected"}, {"version": "0", "lessThan": "6.10", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.103", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.44", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.8", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.12.103"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.18.44"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "7.1.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/21c77486f5a60bb9c0433c21de62a5f25d5091f1"}, {"url": "https://git.kernel.org/stable/c/c835f2b0b7167584832b516c9b0a26e9180d1d0b"}, {"url": "https://git.kernel.org/stable/c/ca41d9f3a21586bf29df53eec05152ecf2b2f94f"}, {"url": "https://git.kernel.org/stable/c/b921b8613790a3f9e78ab64017fa7149ef0b750c"}], "title": "drm/panthor: validate firmware interface structure sizes", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/panthor/panthor_fw.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "21c77486f5a60bb9c0433c21de62a5f25d5091f1", "status": "affected", "version": "2718d91816eeed03c09c8abe872e45f59078768c", "versionType": "git"}, {"lessThan": "c835f2b0b7167584832b516c9b0a26e9180d1d0b", "status": "affected", "version": "2718d91816eeed03c09c8abe872e45f59078768c", "versionType": "git"}, {"lessThan": "ca41d9f3a21586bf29df53eec05152ecf2b2f94f", "status": "affected", "version": "2718d91816eeed03c09c8abe872e45f59078768c", "versionType": "git"}, {"lessThan": "b921b8613790a3f9e78ab64017fa7149ef0b750c", "status": "affected", "version": "2718d91816eeed03c09c8abe872e45f59078768c", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/panthor/panthor_fw.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.10"}, {"lessThan": "6.10", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.103", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.44", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/panthor: validate firmware interface structure sizes\n\niface_fw_to_cpu_addr() only checks that the firmware-provided MCU virtual\naddress points inside the shared section. The returned pointer is later\nused as a full firmware interface structure, so accepting an address near\nthe end of the shared section can still lead to out-of-bounds accesses.\n\nPass the expected object size to iface_fw_to_cpu_addr() and reject ranges\nthat do not fit entirely in the shared section."}], "id": "CVE-2026-74451", "lastModified": "2026-08-17T06:19:40.953", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-15T13:17:49.697", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/21c77486f5a60bb9c0433c21de62a5f25d5091f1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b921b8613790a3f9e78ab64017fa7149ef0b750c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c835f2b0b7167584832b516c9b0a26e9180d1d0b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ca41d9f3a21586bf29df53eec05152ecf2b2f94f"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: drm/panthor: validate firmware interface structure sizes", "id": "2517008", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517008"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-805", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ndrm/panthor: validate firmware interface structure sizes\niface_fw_to_cpu_addr() only checks that the firmware-provided MCU virtual\naddress points inside the shared section. The returned pointer is later\nused as a full firmware interface structure, so accepting an address near\nthe end of the shared section can still lead to out-of-bounds accesses.\nPass the expected object size to iface_fw_to_cpu_addr() and reject ranges\nthat do not fit entirely in the shared section.", "A flaw was found in the `drm/panthor` component of the Linux kernel. The `iface_fw_to_cpu_addr()` function, responsible for validating firmware interface structure sizes, does not adequately check if the firmware-provided Microcontroller Unit (MCU) virtual address fits entirely within the shared memory section. This oversight allows an address near the end of the shared section to be accepted, potentially leading to out-of-bounds memory accesses. Such accesses could result in system instability or information disclosure."], "name": "CVE-2026-74451", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74451\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74451\nhttps://lore.kernel.org/linux-cve-announce/2026081530-CVE-2026-74451-b6af@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2718d91816eeed03c09c8abe872e45f59078768c,21c77486f5a60bb9c0433c21de62a5f25d5091f1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2718d91816eeed03c09c8abe872e45f59078768c,c835f2b0b7167584832b516c9b0a26e9180d1f1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2718d91816eeed03c09c8abe872e45f59078768c,ca41d9f3a21586bf29df53eec05152ecf2b2f94f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2718d91816eeed03c09c8abe872e45f59078768c,b921b8613790a3f9e78ab64017fa7149ef0b750c)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.10"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.10)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.103,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.44,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.8,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "7.2-rc6"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T13:45:03.195531+00:00", "updated": "2026-08-21T22:15:04.719121+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}