CVE-2026-99003 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution maintainers, and users of Linux-based systems should assess exposure and apply patches as necessary. Linux kernel developers, maintainers, and users should review and apply the provided patches to ensure the drm/panthor module is updated.

Why it matters

A vulnerability in the Linux kernel's drm/panthor module has been addressed. The issue arises from a lack of validation between the userspace queue count and the initialized firmware slot count. This could potentially lead to a crash when unprivileged userspace requests more queues than the firmware reported. Linux kernel developers, maintainers, and users should assess exposure and apply patches as necessary.

• Unprivileged userspace may request more queues than the firmware reported, potentially leading to a crash.
• The vulnerability requires validation of userspace queue counts against firmware slot counts to prevent potential crashes.
• Remediation involves applying patches to update the drm/panthor module.

Technical summary

The Linux kernel's drm/panthor module did not properly validate userspace queue counts against initialized firmware slot counts. This could lead to a crash when unprivileged userspace requests more queues than the firmware reported. The vulnerability is located in the panthor_drv.c file, specifically in the panthor_ioctl_group_create() function, where the queue count is validated against a hardcoded maximum. However, if the firmware reports fewer slots than this maximum, the panthor_fw_init_ifaces() function will only initialize that smaller number of stream interfaces.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the provided patches to ensure the drm/panthor module is updated.
• Verify the firmware slot count and userspace queue count validation in the Linux kernel.
• Monitor Linux kernel updates for further patches related to this vulnerability.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source item provide details on the vulnerability. However, the corpus does not establish versions, exploitation, impact, or remediation beyond the provided information. The Linux kernel's drm/panthor module did not properly validate userspace queue counts against initialized firmware slot counts, which could lead to a crash. The vulnerability requires validation of userspace queue counts against firmware slot counts to prevent potential crashes. Remediation involves applying patches to update the drm/panthor module.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.