CVE-2026-68474

powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access()

State: Published
Severity: 7.8 High
Published: Aug 15, 2026
Updated: Aug 17, 2026
Reserved: Jul 30, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access()

spufs_mem_mmap_access() computes the local store offset as address - vma->vm_start, but bounds-checks it against vma->vm_end instead of the local store size. On 64-bit, offset is always well below vma->vm_end, so the clamp never fires and len stays unbounded against the LS_SIZE buffer returned by ctx->ops->get_ls().

Reject offsets at or beyond LS_SIZE and clamp len to the remaining space, mirroring the guard already used by spufs_mem_mmap_fault() and spufs_ps_fault().

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	a352894d07059649398c4769dc8b645e1a1dad88 to before aa7aa8ba40c089762d821e3987aaae19e1f5705cAffected a352894d07059649398c4769dc8b645e1a1dad88 to before d479a7711f8ff127946467b910d947bd971b94edAffected a352894d07059649398c4769dc8b645e1a1dad88 to before 9d3569bfdceda69d5ffd5148901e57b69954d9efAffected a352894d07059649398c4769dc8b645e1a1dad88 to before d97a8f3668949a8a9d1f6202f8c53446f2d89aa7Affected a352894d07059649398c4769dc8b645e1a1dad88 to before 913feef74354c653f10ecd4631df7618a95c49c2Affected a352894d07059649398c4769dc8b645e1a1dad88 to before 3c1e92f75e11a11492b8cb901fceeb9f16ae6415Affected a352894d07059649398c4769dc8b645e1a1dad88 to before 4efa313b15925bdd864784865d6585174979294bAffected a352894d07059649398c4769dc8b645e1a1dad88 to before 47b87f469a35b5ffc81c16eee6b13a9b6c8d55c6Affected
LinuxLinux	2.6.27Affected before 2.6.27Not affected 5.10.261 through 5.10.Not affected 5.15.212 through 5.15.Not affected 6.1.178 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.97 through 6.12.Not affected 6.18.40 through 6.18.Not affected 7.1.5 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

a352894d07059649398c4769dc8b645e1a1dad88 to before aa7aa8ba40c089762d821e3987aaae19e1f5705cAffected
a352894d07059649398c4769dc8b645e1a1dad88 to before d479a7711f8ff127946467b910d947bd971b94edAffected
a352894d07059649398c4769dc8b645e1a1dad88 to before 9d3569bfdceda69d5ffd5148901e57b69954d9efAffected
a352894d07059649398c4769dc8b645e1a1dad88 to before d97a8f3668949a8a9d1f6202f8c53446f2d89aa7Affected
a352894d07059649398c4769dc8b645e1a1dad88 to before 913feef74354c653f10ecd4631df7618a95c49c2Affected
a352894d07059649398c4769dc8b645e1a1dad88 to before 3c1e92f75e11a11492b8cb901fceeb9f16ae6415Affected
a352894d07059649398c4769dc8b645e1a1dad88 to before 4efa313b15925bdd864784865d6585174979294bAffected
a352894d07059649398c4769dc8b645e1a1dad88 to before 47b87f469a35b5ffc81c16eee6b13a9b6c8d55c6Affected

LinuxLinux

2.6.27Affected
before 2.6.27Not affected
5.10.261 through 5.10.*Not affected
5.15.212 through 5.15.*Not affected
6.1.178 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.97 through 6.12.*Not affected
6.18.40 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.