CVE-2026-90409

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/panthor: Add vm_bind region with kbo range overlap check

When a VM is created, caller has to specify the range of the address space

carve-out set aside for mapping kernel BO's. That means vm_bind mappings of

UM-exposed BO's should not intersect with that region, but at the moment

we're not checking this.

At first, I thought of giving these values to drm_gpuvm_init() through its

reserve_{offset, range} arguments, but it turns out that is meant for VM

address spans that are not managed through the usual drm_gpuvm split/merge

circuit, so storing the end of the user VA range at VM creation time and

doing a quick check in the vm_bind ioctl path was the simplest workaround.

The new check also makes sure vm_bind range doesn't overflow the size of a

64-bit unsigned integer. That was already being done further down the call

stack inside drm_gpuvm_sm_map -> drm_gpuvm_range_valid, but it's best to

fail early in the driver

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References