Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-08-15T00:00:00 kernel: powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access() 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CWE-787

In the Linux kernel, the following vulnerability has been resolved: powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access() spufs_mem_mmap_access() computes the local store offset as address - vma->vm_start, but bounds-checks it against vma->vm_end instead of the local store size. On 64-bit, offset is always well below vma->vm_end, so the clamp never fires and len stays unbounded against the LS_SIZE buffer returned by ctx->ops->get_ls(). Reject offsets at or beyond LS_SIZE and clamp len to the remaining space, mirroring the guard already used by spufs_mem_mmap_fault() and spufs_ps_fault().

A flaw was found in the Linux kernel, specifically within the powerpc/spufs component responsible for managing memory access. This vulnerability allows for an out-of-bounds memory access due to incorrect boundary checks in the `spufs_mem_mmap_access()` function. An attacker could exploit this to corrupt memory, potentially leading to system instability (denial of service) or unauthorized privilege escalation.

Red Hat Enterprise Linux 10 Not affected kernel Red Hat Enterprise Linux 6 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel-rt Red Hat Enterprise Linux 8 Not affected kernel Red Hat Enterprise Linux 8 Not affected kernel-rt Red Hat Enterprise Linux 9 Not affected kernel Red Hat Enterprise Linux 9 Not affected kernel-rt https://www.cve.org/CVERecord?id=CVE-2026-68474 https://nvd.nist.gov/vuln/detail/CVE-2026-68474 https://lore.kernel.org/linux-cve-announce/2026081505-CVE-2026-68474-f8a6@gregkh/T