CVE-2026-68474
Description
A flaw was found in the Linux kernel, specifically within the powerpc/spufs component responsible for managing memory access. This vulnerability allows for an out-of-bounds memory access due to incorrect boundary checks in the spufs_mem_mmap_access() function. An attacker could exploit this to corrupt memory, potentially leading to system instability (denial of service) or unauthorized privilege escalation.
Statement
Red Hat has evaluated this issue as having a Moderate security impact because exploitation requires local user privileges and is confined to specialized Cell processor architectures. The Synergistic Processing Unit file system (spufs) is not enabled or built into Red Hat Enterprise Linux kernels, which target enterprise 64-bit Power server platforms. Consequently, standard Red Hat kernel deployments do not include the vulnerable code and remain unaffected.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | 7.8 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | High |
| Integrity Impact | None | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
