{"apiVersion":"1.0","identifier":"CVE-2026-74452","description":"In the Linux kernel, the following vulnerability has been resolved: drm/panthor: reject firmware sections with oversized data In panthor_fw_load_section_entry(), the data size to copy is calculated without validating it against the allocated section_size: section->data.size = hdr.data.end - hdr.data.start; If a crafted firmware sets data.size larger than the allocated memory, this could cause a heap buffer overflow in panthor_fw_init_section_mem() memcpy(section->mem->kmap, section->data.buf, section->data.size); Additionally, if the section->data.size exceeds the BO size, could this memset underflow the size calculation, leading to a massive out-of-bounds zeroing of kernel memory? memset(section->mem->kmap + section->data.size, 0, panthor_kernel_bo_size(section->mem) - section->data.size); Reject section entries whose initial data is larger than the section size.","publishedAt":"2026-08-15T13:17:49","lastModifiedAt":"2026-08-17T06:19:41","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-74452","cvssScore":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","epssProbability":0.00142,"riskScore":0.79,"affectedProduct":"Linux kernel","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-74452","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-74452","en":"https://www.redsauce.net/en/cves/CVE-2026-74452","fr":"https://www.redsauce.net/fr/cves/CVE-2026-74452","pt":"https://www.redsauce.net/pt/cves/CVE-2026-74452","de":"https://www.redsauce.net/de/cves/CVE-2026-74452","sk":"https://www.redsauce.net/sk/cves/CVE-2026-74452","el":"https://www.redsauce.net/el/cves/CVE-2026-74452"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-74452"}}