CVE-2026-80577 Overview
CVE-2026-80577 is a NULL pointer dereference vulnerability in the Linux kernel's drm/panthor driver, which supports ARM Mali GPUs. The flaw resides in panthor_fw_load_section_entry(), where zero-sized firmware sections are added to the firmware section list without allocating a backing buffer object (BO). Subsequent reload and unplug paths iterate the section list and dereference section->mem, triggering a NULL pointer dereference. The upstream fix accepts zero-sized sections as valid no-op entries but excludes them from the section list.
Critical Impact
A malformed or zero-sized firmware section can cause the Panthor GPU driver to dereference a NULL pointer during firmware reload or device unplug, leading to a kernel oops and denial of service.
Affected Products
- Linux kernel versions containing the drm/panthor driver prior to the fix
- Systems using ARM Mali GPUs supported by the Panthor DRM driver
- Stable kernel branches referenced in the upstream commits
Discovery Timeline
- 2026-08-26 - CVE-2026-80577 published to the National Vulnerability Database (NVD)
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-80577
Vulnerability Analysis
The vulnerability exists in the Panthor DRM driver responsible for loading and managing firmware sections used by ARM Mali GPU coprocessors. During firmware initialization, panthor_fw_load_section_entry() parses section descriptors and allocates a backing buffer object for each section's virtual address (VA) range. When a section's VA range is empty, the function correctly skips BO creation, but the section descriptor is still appended to the driver's internal firmware section list.
The result is a list entry whose section->mem pointer is left uninitialized as NULL. Any later code path that walks the section list and touches section->mem will dereference a NULL pointer. The two documented paths that iterate the list are firmware reload and device unplug, both of which are reachable during normal driver lifecycle events.
Root Cause
The root cause is a missing list-insertion guard for zero-sized firmware sections. The BO allocation is correctly conditional on a non-empty VA range, but the corresponding list append is unconditional. This creates a mismatch between what the initializer produces and what the consumers on the reload and unplug paths expect, since consumers assume every entry in the section list has a valid mem pointer. This is a classic NULL pointer dereference caused by inconsistent invariants across code paths [CWE-476].
Attack Vector
Triggering the fault requires the driver to encounter a zero-sized firmware section entry followed by a reload or unplug event. The most direct trigger path is loading firmware that legitimately or maliciously contains a zero-sized section descriptor, then exercising the driver lifecycle. The vulnerability is a kernel-space NULL pointer dereference and manifests as a kernel oops, resulting in denial of service. It is not documented as a path to privilege escalation or arbitrary code execution.
No verified proof-of-concept code is available. For the code-level fix, review the upstream commits: Kernel Git Commit 25556a4, Kernel Git Commit 2b8f13d, Kernel Git Commit 5d222b6, and Kernel Git Commit f0f3c39.
Detection Methods for CVE-2026-80577
Indicators of Compromise
- Kernel oops or panic messages referencing panthor_fw_load_section_entry, firmware reload, or unplug paths in drm/panthor
- NULL pointer dereference stack traces originating from Panthor firmware section iteration
- Unexpected GPU driver resets or hangs on systems using ARM Mali GPUs with the Panthor driver
Detection Strategies
- Inventory Linux hosts running kernels that include the drm/panthor driver and compare against the fixed stable kernel commits.
- Parse dmesg and journal logs for Oops, BUG:, or NULL pointer dereference entries with panthor in the call stack.
- Correlate GPU driver reload or device hot-unplug events with subsequent kernel faults on affected hardware.
Monitoring Recommendations
- Forward kernel logs to a central logging platform and alert on panthor panic signatures.
- Track kernel package versions across the fleet and flag hosts still on pre-patch stable branches.
- Monitor GPU-dependent workloads for unexplained crashes on ARM Mali hardware.
How to Mitigate CVE-2026-80577
Immediate Actions Required
- Update to a Linux stable kernel release that incorporates the upstream fix commits listed in the references.
- Identify all ARM Mali GPU systems using the drm/panthor driver and prioritize them for patching.
- Restrict the ability to load or replace GPU firmware to trusted administrators only.
Patch Information
The fix is available in the mainline and stable Linux kernel trees. Apply the kernel update that includes the referenced commits: Kernel Git Commit 25556a4, Kernel Git Commit 2b8f13d, Kernel Git Commit 5d222b6, and Kernel Git Commit f0f3c39. The patch modifies panthor_fw_load_section_entry() to accept zero-sized sections as no-ops without adding them to the firmware section list, ensuring downstream consumers never encounter an entry with a NULL mem pointer.
Workarounds
- Unload the panthor kernel module on systems that do not require Mali GPU acceleration until the patched kernel is deployed.
- Avoid firmware reload operations and GPU device hot-unplug on unpatched systems.
- Limit exposure by ensuring only vendor-signed firmware images are present in /lib/firmware.
# Verify running kernel version and check for the Panthor module
uname -r
lsmod | grep panthor
# Temporary mitigation: prevent panthor from loading until patched
echo "blacklist panthor" | sudo tee /etc/modprobe.d/blacklist-panthor.conf
sudo update-initramfs -u
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
