In the Linux kernel’s Panthor DRM driver, firmware sections are loaded by calculating the data size without verifying it against the memory allocated for that section. When a crafted firmware file contains a data field larger than the allocated space, the driver copies the oversized data using memcpy, leading to a heap buffer overflow. The same vulnerability can cause a massive out‑of‑bounds zeroing of kernel memory through an unchecked memset. This results in corruption of arbitrary kernel memory, which a local attacker could exploit to execute arbitrary code or gain elevated privileges.

The vulnerability affects the Linux kernel’s Panthor DRM driver that handles external firmware files. No specific kernel versions are listed, indicating that the flaw exists in the driver code before the latest patch. Users running any kernel that includes the panthor firmware loading path and has not received the patch are potentially exposed.

The CVSS score of 7.8 indicates high severity. The EPSS score of < 1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is local or requires privileged access to load a custom firmware image. If an attacker can supply such a firmware file, the overflow can lead to kernel memory corruption and maximum compromise of the system.