CVE-2026-99003 drm/panthor: validate userspace queue count against initialized firmware slot count
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-99003?
CVE-2026-99003 is a vulnerability in Linux, published on 23 Oct 2026.
Official description
In the Linux kernel, the following vulnerability has been resolved:
drm/panthor: validate userspace queue count against initialized firmware slot count
In panthor_drv.c:panthor_ioctl_group_create(), the queue count is validated against the hardcoded maximum:
if (!args->queues.count || args->queues.count > MAX_CS_PER_CSG) return -EINVAL;
However, if the firmware reports fewer slots than MAX_CS_PER_CSG, panthor_fw_init_ifaces() will only initialize that smaller number of stream interfaces.
If unprivileged userspace requests more queues than the firmware reported (but no more than MAX_CS_PER_CSG), cs_slot_prog_locked() fetches an uninitialized stream interface and may crash when dereferencing cs_iface->input->ringbuf_base.
Which versions are affected by CVE-2026-99003?
How do I fix CVE-2026-99003?
Upgrade to a fixed version.
Is CVE-2026-99003 being exploited?
There is no known exploitation of CVE-2026-99003 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-99003, DEBIAN-CVE-2026-99003, GHSA-chr3-6fxw-gjw4, UBUNTU-CVE-2026-99003.