CVE-2026-89825

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The 32-bit stride overflow is reached only on the local panthor probe path (panthor_probe → panthor_device_init → panthor_fw_init → panthor_fw_start → panthor_fw_init_ifaces → panthor_init_csg_iface/panthor_init_cs_iface) when mapping firmware-provided group_stride/stream_stride from mali_csffw.bin; no network, Bluetooth, or USB handler feeds those fields.

AC:LAttack complexity, low

Firmware fully controls group_stride, stream_stride, and group_num (MIN_CSGS is 3, so csg_idx>=1 always runs). A crafted stride that places the u32 offset near 2^32 makes offset+sizeof wrap to a small value and pass the bounds check deterministically, with no race or attacker-uncontrollable timing.

PR:LPrivileges required, low

The parser applies no capability check to firmware contents. On Mali CSF Android phones, Chromebooks, and embedded boards, mali_csffw.bin commonly lives on vendor/firmware partitions writable by local non-root system or vendor service accounts, which is sufficient to plant the crafted blob before driver probe.

UI:NUser interaction, none

Once the crafted firmware is in place, panthor_fw_init_ifaces() runs automatically at driver probe and caches the resulting interface pointers; no separate victim action such as opening a file, mounting a filesystem, or using /dev/dri is required to trigger the overflow.

S:UScope, unchanged

The bug corrupts kernel memory past the firmware shared-section vmap and can enable local privilege escalation within the host kernel; it does not cross a VM, IOMMU, or sandbox boundary such as a KVM guest-to-host escape.

C:HConfidentiality impact, high

A wrapped u32 iface_offset near 2^32 yields kmap plus a ~4GiB out-of-bounds control pointer; the kernel then reads panthor_fw_*_control_iface fields (input_va, output_va, stream_num, stream_stride, features) from that address, disclosing kernel memory rather than a few bounded bytes.

I:HIntegrity impact, high

Those OOB control pointers are cached for the device lifetime and consumed by scheduler, job-IRQ, and GROUP_CREATE paths that write panthor_fw_*_input_iface structures and allocate suspend buffers from control->suspend_size, enabling out-of-bounds kernel writes and control-flow hijacking.

A:HAvailability impact, high

Dereferencing kmap plus a wrapped near-4GiB offset can immediately oops or panic if the region is unmapped, and a corrupted firmware interface leaves the Mali GPU unusable; the same path is hit on every probe or firmware boot until the blob is removed.