CVE-2026-68445: drm/vc4: Prevent shader BO mappings from becoming writable
In the Linux kernel, the following vulnerability has been resolved:
drm/vc4: Prevent shader BO mappings from becoming writable
vc4gemobjectmmap() rejects a writable mapping of a validated shader BO, but leaves VMMAYWRITE set. Userspace can map the BO read-only and then turn it writable with mprotect().
Validated shader BOs must stay read-only: the validator checks the instructions once and the GPU trusts them afterwards. A writable mapping lets userspace rewrite the code after validation, bypassing the validator.
Clear VMMAYWRITE on the read-only path so the mapping cannot be upgraded, as i915 already does for its read-only objects.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure the read-only mapping path clears VM_MAYWRITE so the mapping cannot be turned writable (e.g., prevent userspace from making the mapping writable after it is mapped read-only).
Linux kernel (drm/vc4) VM_MAYWRITE on read-only BO mappings = clear (unset) VM_MAYWRITE on the read-only path
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68445?
CVE-2026-68445 has a risk rating of 55, indicating a moderate severity level.
What does CVE-2026-68445 affect?
CVE-2026-68445 affects the Linux kernel's graphic rendering component, specifically the vc4 driver.
How do I fix CVE-2026-68445?
To fix CVE-2026-68445, update your Linux kernel to a version where this vulnerability has been patched.
What are the main issues caused by CVE-2026-68445?
CVE-2026-68445 can allow unauthorized writing to shader buffer objects, leading to potential memory corruption.
Is CVE-2026-68445 exploited in the wild?
As of now, there have been no confirmed reports of CVE-2026-68445 being actively exploited in the wild.