In the Linux kernel driver for Panthor DRM, the function iface_fw_to_cpu_addr() verifies that a firmware-provided virtual address lies within a shared firmware region but does not ensure the entire data structure referenced by that address fits within the region. An attacker can supply a pointer near the end of the shared section, causing subsequent accesses to spill over into adjacent memory. This out-of-bounds behavior can lead to arbitrary memory corruption, potentially enabling code execution or information disclosure. The flaw is a classic example of an unchecked pointer bounds violation.

The vulnerability affects all Linux kernel installations that include the drm/panthor driver and allow loading of external GPU firmware. No specific kernel version is listed, so any kernel containing the unpatched drm/panthor implementation is vulnerable. The attack surface includes devices that use Panthor GPUs and rely on the kernel to validate firmware interface structures.

Without a publicly reported exploit, the EPSS score of less than 1% indicates a very low probability of exploitation, but the kernel level nature of the flaw and its ability to corrupt memory mean the risk remains high. Successful exploitation would likely require local or privileged access to load malicious firmware; a remote exploit would need a mechanism to inject firmware, which is uncommon. The attack vector is inferred to be local privilege escalation via tampered firmware. The CVSS score of 7.8 indicates high severity, and given the potential for arbitrary code execution, the vulnerability should be treated as critical until a patch is deployed.