CVE-2026-90409 drm/panthor: Add vm_bind region with kbo range overlap check
Missing overlap check in Panthor GPU driver allows local attackers to map kernel buffers, potentially leading to privilege escalation or code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-90409?
CVE-2026-90409 is a missing authorization vulnerability in Linux, published on 17 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
drm/panthor: Add vm_bind region with kbo range overlap check
When a VM is created, caller has to specify the range of the address space carve-out set aside for mapping kernel BO's. That means vm_bind mappings of UM-exposed BO's should not intersect with that region, but at the moment we're not checking this.
At first, I thought of giving these values to drm_gpuvm_init() through its reserve_{offset, range} arguments, but it turns out that is meant for VM address spans that are not managed through the usual drm_gpuvm split/merge circuit, so storing the end of the user VA range at VM creation time and doing a quick check in the vm_bind ioctl path was the simplest workaround.
The new check also makes sure vm_bind range doesn't overflow the size of a 64-bit unsigned integer. That was already being done further down the call stack inside drm_gpuvm_sm_map -> drm_gpuvm_range_valid, but it's best to fail early in the driver before GPUVM functions are invoked so that we won't waste time allocating vm_bind context resources.
Which versions are affected by CVE-2026-90409?
How do I fix CVE-2026-90409?
Apply the vendor's patch.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-90409 being exploited?
There is no known exploitation of CVE-2026-90409 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-90409, DEBIAN-CVE-2026-90409, GHSA-8w4v-ph57-xf5x, UBUNTU-CVE-2026-90409.