In the Linux kernel’s Panthor DRM driver, a firmware loader incorrectly computes the amount of data to copy into a section without verifying that the computed size does not exceed the memory allocated for that section. This leads to a classic heap overflow when a crafted firmware file contains a data field larger than the allocated size, potentially corrupting arbitrary kernel memory through a memcpy operation and, if the overflow is large enough, zeroing out memory beyond the intended region during a memset. The resulting memory corruption can allow a local attacker who can load firmware to gain kernel privileges or execute arbitrary code.

The vulnerability affects the Linux kernel, specifically the Panthor DRM driver responsible for handling external firmware files. No specific kernel versions are listed, indicating that the flaw exists in the driver code before the latest patch. Users running any kernel that includes the panthor firmware loading path and has not received the patch are potentially exposed.

The risk level is significant because the flaw modifies kernel memory and is not mitigated by sandboxing. The EPSS score is not available, but the absence from the CISA KEV catalog does not diminish the severity. The attack vector is likely local or requires privileged firmware injection, so an attacker must be able to provide a custom firmware image to the kernel. If that condition is met, the exploitation could lead to total compromise of the targeted system.