In the Linux kernel, the following vulnerability has been resolved:
drm/panthor: Restrict high priorities on group_create
We were allowing any users to create a high priority group without any permission checks. As a result, this was allowing possible denial of service.
We now only allow the DRM master or users with the CAP_SYS_NICE capability to set higher priorities than PANTHOR_GROUP_PRIORITY_MEDIUM.
As the sole user of that uAPI lives in Mesa and hardcode a value of MEDIUM [1], this should be safe to do.
Additionally, as those checks are performed at the ioctl level, panthor_group_create now only check for priority level validity.
[1]https://gitlab.freedesktop.org/mesa/mesa/-/blob/f390835074bdf162a63deb0311d1a6de527f9f89/src/gallium/drivers/panfrost/pan_csf.c#L1038
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 27, 2026 | Jul 27, 2026 |
| Suse | — | Upgrade kernel-macrosUpgrade kernel-64kbUpgrade kernel-symsUpgrade kernel-docsUpgrade kernel-64kb-develUpgrade kernel-zfcpdumpUpgrade kernel-sourceUpgrade kernel-default-develUpgrade kernel-develUpgrade kernel-defaultUpgrade reiserfs-kmp-defaultUpgrade kernel-obs-build | Dec 5, 2025 | Dec 5, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub