CVE-2026-89825

HighCVSS 7.8/10Last modified Oct 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/panthor: fix firmware control interface bounds checks

panthor_init_cs_iface() and panthor_init_csg_iface() validate firmware control interface offsets with 32-bit arithmetic and the size of the host wrapper structures. The offsets are derived from firmware-provided strides, so the arithmetic can wrap before the bounds check, and the host wrapper size is not the size of the firmware control interface being mapped.

Use 64-bit arithmetic for the computed offsets and validate against the actual firmware control interface structure sizes with subtraction-based bounds checks. Also validate that the shared section is large enough for the global control interface before using it.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 2718d91816eeed03c09c8abe872e45f59078768c, < 33ae55809aee9b4dca1d00cdee35b527f2bf8626; >= 2718d91816eeed03c09c8abe872e45f59078768c, < 80c9528661c774f899281c9a72011208ff39929e; >= 2718d91816eeed03c09c8abe872e45f59078768c, < 3e5c7cddc0073eef6f9bb373189b11a969f1f6f6; >= 2718d91816eeed03c09c8abe872e45f59078768c, < 6a47f9fd2d970674ed9dedc52fc7ab76fd015785
LinuxLinux6.10

References

Timeline

Published
Sep 16, 2026
Last modified
Oct 19, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-898267.1In the Linux kernel, the following vulnerability has been resolved: drm/panthor: harden firmware build-info bounds checks panthor_fw_read_CVE-2026-89827In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: avoid force-completing uninitialized UVD rings uvd_v7_0_swCVE-2026-89828In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix init ordering in amdgpu_vram_mgr_init() drmm_cgroup_reCVE-2026-898297.8In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to pass folio->index to f2fs_sanity_check_node_footer() OtheCVE-2026-89839.8Autel Maxi Charger Single firmware through V1.03.51 contains a hard-coded authentication token that bypasses authorization checks for multipCVE-2026-89830In the Linux kernel, the following vulnerability has been resolved: f2fs: fix valid block count leak on data block allocation failure In _CVE-2026-89831In the Linux kernel, the following vulnerability has been resolved: f2fs: protect critical_task_priority updates with s_umount The sysfs sCVE-2026-898327.8In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to clear dirty flag on folio in error path If node block is CVE-2026-89833In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages() ThereCVE-2026-89834In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to migrate all curseg types during free_segment_range In freCVE-2026-89835In the Linux kernel, the following vulnerability has been resolved: f2fs: avoid NULL checkpoint thread access in sysfs checkpoint_merge caCVE-2026-898367.8In the Linux kernel, the following vulnerability has been resolved: f2fs: fix folio_nr_pages() race after put in large folio invalidate Ou
CVE-2026-89825: High severity, CVSS 7.8 | Vulnix