CVE-2026-99003

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99003", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.385Z", "datePublished": "2026-10-23T12:20:24.476Z", "dateUpdated": "2026-10-23T12:20:24.476Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-23T12:20:24.476Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/panthor: validate userspace queue count against initialized firmware slot count\n\nIn panthor_drv.c:panthor_ioctl_group_create(),\nthe queue count is validated against the hardcoded maximum:\n\n\tif (!args->queues.count || args->queues.count > MAX_CS_PER_CSG)\n\t\treturn -EINVAL;\n\nHowever, if the firmware reports fewer slots than MAX_CS_PER_CSG,\npanthor_fw_init_ifaces() will only initialize that smaller number of\nstream interfaces.\n\nIf unprivileged userspace requests more queues than the firmware reported\n(but no more than MAX_CS_PER_CSG), cs_slot_prog_locked() fetches an\nuninitialized stream interface and may crash when dereferencing\ncs_iface->input->ringbuf_base."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/panthor/panthor_sched.c"], "versions": [{"version": "de85488138247d034eb3241840424a54d660926b", "lessThan": "4487cf79bf173f2b426a02d102076f8a20d23b96", "status": "affected", "versionType": "git"}, {"version": "de85488138247d034eb3241840424a54d660926b", "lessThan": "fdee3570b282a6c8699aea63fa5694355e010ec9", "status": "affected", "versionType": "git"}, {"version": "de85488138247d034eb3241840424a54d660926b", "lessThan": "9be126be5f78bc331a930295af97c9b1f9158f06", "status": "affected", "versionType": "git"}, {"version": "de85488138247d034eb3241840424a54d660926b", "lessThan": "ec86c43dcfff68eab4db9bdafcd3e2b16e342e18", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/panthor/panthor_sched.c"], "versions": [{"version": "6.10", "status": "affected"}, {"version": "0", "lessThan": "6.10", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.113", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.57", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.11", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.12.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.18.57"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "7.2.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/4487cf79bf173f2b426a02d102076f8a20d23b96"}, {"url": "https://git.kernel.org/stable/c/fdee3570b282a6c8699aea63fa5694355e010ec9"}, {"url": "https://git.kernel.org/stable/c/9be126be5f78bc331a930295af97c9b1f9158f06"}, {"url": "https://git.kernel.org/stable/c/ec86c43dcfff68eab4db9bdafcd3e2b16e342e18"}], "title": "drm/panthor: validate userspace queue count against initialized firmware slot count", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/panthor/panthor_sched.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "4487cf79bf173f2b426a02d102076f8a20d23b96", "status": "affected", "version": "de85488138247d034eb3241840424a54d660926b", "versionType": "git"}, {"lessThan": "fdee3570b282a6c8699aea63fa5694355e010ec9", "status": "affected", "version": "de85488138247d034eb3241840424a54d660926b", "versionType": "git"}, {"lessThan": "9be126be5f78bc331a930295af97c9b1f9158f06", "status": "affected", "version": "de85488138247d034eb3241840424a54d660926b", "versionType": "git"}, {"lessThan": "ec86c43dcfff68eab4db9bdafcd3e2b16e342e18", "status": "affected", "version": "de85488138247d034eb3241840424a54d660926b", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/panthor/panthor_sched.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.10"}, {"lessThan": "6.10", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.113", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.57", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/panthor: validate userspace queue count against initialized firmware slot count\n\nIn panthor_drv.c:panthor_ioctl_group_create(),\nthe queue count is validated against the hardcoded maximum:\n\n\tif (!args->queues.count || args->queues.count > MAX_CS_PER_CSG)\n\t\treturn -EINVAL;\n\nHowever, if the firmware reports fewer slots than MAX_CS_PER_CSG,\npanthor_fw_init_ifaces() will only initialize that smaller number of\nstream interfaces.\n\nIf unprivileged userspace requests more queues than the firmware reported\n(but no more than MAX_CS_PER_CSG), cs_slot_prog_locked() fetches an\nuninitialized stream interface and may crash when dereferencing\ncs_iface->input->ringbuf_base."}], "id": "CVE-2026-99003", "lastModified": "2026-10-23T13:17:22.670", "metrics": {}, "published": "2026-10-23T13:17:22.670", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4487cf79bf173f2b426a02d102076f8a20d23b96"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9be126be5f78bc331a930295af97c9b1f9158f06"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ec86c43dcfff68eab4db9bdafcd3e2b16e342e18"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/fdee3570b282a6c8699aea63fa5694355e010ec9"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: drm/panthor: validate userspace queue count against initialized firmware slot count", "id": "2559838", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559838"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-824", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ndrm/panthor: validate userspace queue count against initialized firmware slot count\nIn panthor_drv.c:panthor_ioctl_group_create(),\nthe queue count is validated against the hardcoded maximum:\nif (!args->queues.count || args->queues.count > MAX_CS_PER_CSG)\nreturn -EINVAL;\nHowever, if the firmware reports fewer slots than MAX_CS_PER_CSG,\npanthor_fw_init_ifaces() will only initialize that smaller number of\nstream interfaces.\nIf unprivileged userspace requests more queues than the firmware reported\n(but no more than MAX_CS_PER_CSG), cs_slot_prog_locked() fetches an\nuninitialized stream interface and may crash when dereferencing\ncs_iface->input->ringbuf_base.", "A flaw was found in the Linux kernel's Panthor Direct Rendering Manager (DRM) driver. When the hardware firmware initializes fewer queue slots than the driver's hardcoded maximum, the driver fails to properly validate the requested queue count against the actual initialized firmware slots. A local unprivileged attacker could exploit this flaw by submitting a request with more queues than supported by the firmware, leading to an uninitialized memory dereference, a system crash, and a Denial of Service (DoS)."], "name": "CVE-2026-99003", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-23T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-99003\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-99003\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99003.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[de85488138247d034eb3241840424a54d660926b,4487cf79bf173f2b426a02d102076f8a20d23b96)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[de85488138247d034eb3241840424a54d660926b,fdee3570b282a6c8699aea63fa5694355e010ec9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[de85488138247d034eb3241840424a54d660926b,9be126be5f78bc331a930295af97c9b1f9158f06)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[de85488138247d034eb3241840424a54d660926b,ec86c43dcfff68eab4db9bdafcd3e2b16e342e18)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.10"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.10)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.12.113,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.57,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2.11,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[de85488138247d034eb3241840424a54d660926b,4487cf79bf173f2b426a02d102076f8a20d23b96)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[de85488138247d034eb3241840424a54d660926b,fdee3570b282a6c8699aea63fa5694355e010ec9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[de85488138247d034eb3241840424a54d660926b,9be126be5f78bc331a930295af97c9b1f9158f06)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[de85488138247d034eb3241840424a54d660926b,ec86c43dcfff68eab4db9bdafcd3e2b16e342e18)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.10"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.10)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.12.113,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.57,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2.11,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-23T17:00:15.615395+00:00", "updated": "2026-10-29T22:15:04.247277+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"]}