CVE-2026-74452

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The overflow is reached only when panthor_fw_load() parses mali_csffw.bin from the local firmware search path during platform probe (panthor_probe→panthor_fw_init→panthor_fw_load_section_entry→panthor_fw_init_section_mem); no network, DRM ioctl, or /dev/dri/renderD* path feeds attacker-controlled firmware headers.

AC:LAttack complexity, low

An attacker fully controls firmware section header fields (data.start/end versus va.start/end); once a malicious blob is in the firmware path, parsing deterministically performs an oversized memcpy and, with ZERO set, an underflowed memset on every load and on GPU-reset reloads without races or uncontrollable layout.

PR:LPrivileges required, low

The parser performs no capability or authentication checks on firmware content; on Mali CSF Android, Chromebook, and embedded deployments the GPU firmware image commonly lives on vendor/firmware partitions writable by local non-root system or vendor service accounts, sufficient to plant the crafted blob before driver probe.

UI:NUser interaction, none

After the malicious firmware file is in place, parsing runs automatically at driver probe or GPU-reset section reload with no separate victim action; an attacker does not need another user to open a device node or mount a filesystem to trigger the bug.

S:UScope, unchanged

Impact is kernel heap corruption and potential local privilege escalation within the same kernel security domain; it does not cross a VM, IOMMU, or sandbox boundary such as guest-to-host escape.

C:HConfidentiality impact, high

The unchecked memcpy copies attacker-controlled firmware bytes past the allocated shmem BO mapping, and the memset length underflow can zero far beyond the buffer, giving out-of-bounds read/write primitives over adjacent kernel heap objects rather than a bounded leak.

I:HIntegrity impact, high

Heap buffer overflow plus attacker-controlled firmware content enables arbitrary kernel memory corruption; the ZERO-flag memset underflow can perform a massive out-of-bounds zero write exploitable for control-flow hijacking and local privilege escalation.

A:HAvailability impact, high

Oversized memcpy and underflowed memset corrupt kernel heap memory and can immediately kernel oops or panic; the same corruption is re-triggered on GPU reset via panthor_reload_fw_sections(), enabling repeatable denial of service.