CVE-2026-74451

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

Out-of-bounds kernel accesses occur when panthor_fw_init_ifaces() accepts firmware MCU input_va/output_va at probe, then runtime DRM paths (GROUP_SUBMIT, scheduling, job IRQ handlers) dereference those cached interface pointers via /dev/dri/renderD* ioctls; no network or physical access is involved.

AC:LAttack complexity, low

Once malicious or mis-layouted firmware publishes interface VAs near the shared-section end, iface_fw_to_cpu_addr() deterministically returns out-of-bounds pointers and every GPU submission or firmware event reliably performs the same OOB reads/writes without races or uncontrollable heap layout.

PR:LPrivileges required, low

Planting a crafted mali_csffw.bin that makes the MCU publish bad interface VAs is feasible for local vendor/system accounts on Mali Android, Chromebook, and embedded firmware partitions; triggering the corruption afterward requires only standard render-node access (DRM_RENDER_ALLOW), not real init-namespace root.

UI:NUser interaction, none

After the bad interface pointers are established at driver probe or firmware boot, exploitation is driven entirely by the attacker's own GPU ioctl submissions and does not require any separate victim to open files, mount filesystems, or perform other interactive actions.

S:UScope, unchanged

The bug corrupts kernel heap memory adjacent to the firmware shared-section BO and can enable local privilege escalation within the host kernel, but it does not cross a VM, IOMMU, or sandbox boundary such as a KVM guest-to-host escape.

C:HConfidentiality impact, high

Kernel code routinely READ_ONCEs large panthor_fw_*_output_iface structures (fault_info, status_wait_sync_ptr, heap metadata, etc.) through pointers that can extend hundreds of bytes past the shared BO, yielding out-of-bounds kernel memory disclosure rather than a bounded leak.

I:HIntegrity impact, high

Kernel code writes full panthor_fw_*_input_iface structures (ringbuf_base, heap_start/end, req/ack fields via panthor_fw_update_reqs) through the same undersized mappings, enabling out-of-bounds kernel writes exploitable for control-flow hijacking and local privilege escalation.

A:HAvailability impact, high

Out-of-bounds reads and writes against the vmap of the firmware shared-section BO can immediately trigger kernel oopses or panics and remain reachable on every subsequent GPU job submission or firmware interrupt until the driver is reloaded.