CVE-2026-68474: powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access()
In the Linux kernel, the following vulnerability has been resolved:
powerpc/spufs: fix out-of-bounds access in spufsmemmmapaccess()
spufsmemmmapaccess() computes the local store offset as address - vma->vmstart, but bounds-checks it against vma->vmend instead of the local store size. On 64-bit, offset is always well below vma->vmend, so the clamp never fires and len stays unbounded against the LSSIZE buffer returned by ctx->ops->getls().
Reject offsets at or beyond LSSIZE and clamp len to the remaining space, mirroring the guard already used by spufsmemmmapfault() and spufspsfault().
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68474?
CVE-2026-68474 has a risk rating of 33, indicating a moderate level of severity.
What is CVE-2026-68474 about?
CVE-2026-68474 addresses an out-of-bounds access vulnerability in the spufs_mem_mmap_access function in the Linux kernel.
How do I fix CVE-2026-68474?
To fix CVE-2026-68474, update the Linux kernel to a version that includes the patch for this vulnerability.
What systems are affected by CVE-2026-68474?
CVE-2026-68474 affects systems running the affected versions of the Linux kernel that use PowerPC architecture.
How can CVE-2026-68474 impact my system?
Exploiting CVE-2026-68474 may allow an attacker to trigger out-of-bounds access leading to potential system instability or data exposure.