In the Linux kernel, the following vulnerability has been resolved: drm/panthor: validate userspace queue count against initialized firmware slot… (CVE-2026-99003)

The Linux kernel's drm/panthor driver contained a flaw in panthor_ioctl_group_create() where the userspace queue count was validated only against a hardcoded maximum (MAX_CS_PER_CSG) rather than the actual number of stream interfaces initialized by the firmware. If the firmware reported fewer slots than MAX_CS_PER_CSG, but userspace requested a queue count greater than the firmware's count (yet less than or equal to MAX_CS_PER_CSG), the driver would fetch an uninitialized stream interface in cs_slot_prog_locked(), potentially causing a crash when dereferencing cs_iface->input->ringbuf_base. This vulnerability has been resolved.

An unprivileged user could cause a denial of service by triggering a kernel crash due to dereferencing uninitialized memory in the drm/panthor driver. There is no indication of privilege escalation or code execution from the provided data.

A fix for this vulnerability has been implemented in the Linux kernel. Users should update to the patched kernel version once available. Since this is a kernel-level issue, applying the official kernel update is the recommended remediation.