CVE-2026-99003

In the Linux kernel, the following vulnerability has been resolved:

drm/panthor: validate userspace queue count against initialized firmware slot count

In panthor drv.c:panthor ioctl group create(), the queue count is validated against the hardcoded maximum:

if (!args->queues.count || args->queues.count > MAX CS PER CSG)
	return -EINVAL;

However, if the firmware reports fewer slots than MAX CS PER CSG, panthor fw init ifaces() will only initialize that smaller number of stream interfaces.

If unprivileged userspace requests more queues than the firmware reported (but no more than MAX CS PER CSG), cs slot prog locked() fetches an uninitialized stream interface and may crash when dereferencing cs iface->input->ringbuf base.