CVE-2026-89826

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the panthor fw read build info() function where bounds checks for firmware build-info are insufficient. The function validates the metadata range using the addition of hdr.meta start and hdr.meta size; since both are u32 fields, an integer wrap can occur, allowing an out-of-bounds range to pass validation. Additionally, the function reads the "git sha: " prefix without verifying if the metadata is sufficiently long, and a meta size of 0 can lead to an underflow of the NULL terminator index.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.