CVE-2026-99003
In the Linux kernel, the following vulnerability has been resolved: drm/panthor: validate userspace queue count against initialized firmware slot count In panthor_drv.c:panthor_ioctl_group_create(), the queue count is validated against the hardcoded maximum: if (!args->queues.count || args->queues.count > MAX_CS_PER_CSG) return -EINVAL; However, if the firmware reports fewer slots than MAX_CS_PER_CSG, panthor_fw_init_ifaces() will only initialize that smaller number of stream interfaces. If unprivileged userspace requests more queues than the firmware reported (but no more than MAX_CS_PER_CSG), cs_slot_prog_locked() fetches an uninitialized stream interface and may crash when dereferencing cs_iface->input->ringbuf_base.
Affected versions
Linux kernel versions
6.10
and later are affected. Fixed in
6.12.113,
6.18.57,
7.2.11,
7.3
and their respective stable series.
References
4 totalFrequently asked questions
-
What is CVE-2026-99003?
CVE-2026-99003 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 6.10 onward and has been patched in 6.12.113, 6.18.57, 7.2.11 and others. CVE-2026-99003 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-99003?
Yes. CVE-2026-99003 has been patched. Fixed versions include 6.12.113, 6.18.57, 7.2.11 and others. If you are running Linux kernel 6.10 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-99003 actively exploited?
No. CVE-2026-99003 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.