CVE-2026-68474powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access() spufs_mem_mmap_access() computes the local store offset as address - vma->vm_start, but bounds-checks it against vma->vm_end instead of the local store size. On 64-bit, offset is always well below vma->vm_end, so the clamp never fires and len stays unbounded against the LS_SIZE buffer returned by ctx->ops->get_ls(). Reject offsets at or beyond LS_SIZE and clamp len to the remaining space, mirroring the guard already used by spufs_mem_mmap_fault() and spufs_ps_fault().
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from a352894d07059649398c4769dc8b645e1a1dad88 before aa7aa8ba40c089762d821e3987aaae19e1f5705c; from a352894d07059649398c4769dc8b645e1a1dad88 before d479a7711f8ff127946467b910d947bd971b94ed; from a352894d07059649398c4769dc8b645e1a1dad88 before 9d3569bfdceda69d5ffd5148901e57b69954d9ef; from a352894d07059649398c4769dc8b645e1a1dad88 before d97a8f3668949a8a9d1f6202f8c53446f2d89aa7; from a352894d07059649398c4769dc8b645e1a1dad88 before 913feef74354c653f10ecd4631df7618a95c49c2; from a352894d07059649398c4769dc8b645e1a1dad88 before 3c1e92f75e11a11492b8cb901fceeb9f16ae6415; from a352894d07059649398c4769dc8b645e1a1dad88 before 4efa313b15925bdd864784865d6585174979294b; from a352894d07059649398c4769dc8b645e1a1dad88 before 47b87f469a35b5ffc81c16eee6b13a9b6c8d55c6 | CNA record |
References
- https://git.kernel.org/stable/c/aa7aa8ba40c089762d821e3987aaae19e1f5705c
- https://git.kernel.org/stable/c/d479a7711f8ff127946467b910d947bd971b94ed
- https://git.kernel.org/stable/c/9d3569bfdceda69d5ffd5148901e57b69954d9ef
- https://git.kernel.org/stable/c/d97a8f3668949a8a9d1f6202f8c53446f2d89aa7
- https://git.kernel.org/stable/c/913feef74354c653f10ecd4631df7618a95c49c2
- https://git.kernel.org/stable/c/3c1e92f75e11a11492b8cb901fceeb9f16ae6415
- https://git.kernel.org/stable/c/4efa313b15925bdd864784865d6585174979294b
- https://git.kernel.org/stable/c/47b87f469a35b5ffc81c16eee6b13a9b6c8d55c6
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.