A Linux kernel DRM Panthor driver flaw allows an unprivileged user to specify a queue count up to the hard‑coded maximum. When the firmware advertises fewer stream slots than this maximum, the driver allocates a structure that has not been initialized, leading to a dereference of an uninitialized pointer. The resulting kernel panic is a denial of service, and the bug relates to improper validation and dereference of uninitialized memory. This bug is associated with CWE‑824.

The issue affects Linux kernel implementations that include the DRM Panthor driver. No specific kernel release is listed in the advisory, so any kernel containing the unpatched panthor_drv.c code is potentially vulnerable.

The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog, indicating low publicly documented exploitation data. The CVSS score of 5.5 places this flaw in the medium severity range. The attack requires a local unprivileged user to invoke the panthor_ioctl_group_create ioctl with an oversized queue count. Successful exploitation will crash the kernel, leading to a reboot or service interruption, but there is no known escalation to code execution or data theft. Given the local nature and the impact of a crash, administrators should treat this as a moderate‑to‑high risk until patched.