Vulnerability-Lookup

FKIE_CVE-2026-68262

Vulnerability from fkie_nvd - Published: 2026-08-10 13:20 - Updated: 2026-08-17 05:18

Severity

7.1 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Summary

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Fix user array stride in pvr_set_uobj_array() pvr_set_uobj_array() copies an array of kernel objects to a userspace array whose element size is described by out->stride. When out->stride is different from the kernel object size, the slow path advances the userspace pointer by the kernel object size and the kernel pointer by the userspace stride. This reverses the intended layout. For larger userspace strides, later copies read from the wrong kernel addresses. For smaller userspace strides, later copies are written at the wrong userspace offsets. The padding clear is also done only for the first element instead of the padding area for each element. Advance the userspace pointer by out->stride and the kernel pointer by obj_size, and clear per-element padding while the current userspace pointer is still available.

References

	URL	Tags
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/09beaf4aec05b0525f2153dce693f3eb3166697a
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/8dc8f3f4c2382fb7d1b1986ba8f33a2466cd3d7a
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/b983a35dad3701399c692d7c6eb57d8b6ffc0929
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/bbebc39a70f6fc9b02637c8624349e30325873cb

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/imagination/pvr_drv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "bbebc39a70f6fc9b02637c8624349e30325873cb",
              "status": "affected",
              "version": "f99f5f3ea7efd54ba0529c4f2d7c72712918a522",
              "versionType": "git"
            },
            {
              "lessThan": "b983a35dad3701399c692d7c6eb57d8b6ffc0929",
              "status": "affected",
              "version": "f99f5f3ea7efd54ba0529c4f2d7c72712918a522",
              "versionType": "git"
            },
            {
              "lessThan": "09beaf4aec05b0525f2153dce693f3eb3166697a",
              "status": "affected",
              "version": "f99f5f3ea7efd54ba0529c4f2d7c72712918a522",
              "versionType": "git"
            },
            {
              "lessThan": "8dc8f3f4c2382fb7d1b1986ba8f33a2466cd3d7a",
              "status": "affected",
              "version": "f99f5f3ea7efd54ba0529c4f2d7c72712918a522",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/imagination/pvr_drv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/imagination: Fix user array stride in pvr_set_uobj_array()\n\npvr_set_uobj_array() copies an array of kernel objects to a userspace\narray whose element size is described by out-\u003estride. When out-\u003estride\nis different from the kernel object size, the slow path advances the\nuserspace pointer by the kernel object size and the kernel pointer by the\nuserspace stride.\n\nThis reverses the intended layout. For larger userspace strides, later\ncopies read from the wrong kernel addresses. For smaller userspace\nstrides, later copies are written at the wrong userspace offsets. The\npadding clear is also done only for the first element instead of the\npadding area for each element.\n\nAdvance the userspace pointer by out-\u003estride and the kernel pointer by\nobj_size, and clear per-element padding while the current userspace\npointer is still available."
    }
  ],
  "id": "CVE-2026-68262",
  "lastModified": "2026-08-17T05:18:28.580",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.2,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-08-10T13:20:14.990",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/09beaf4aec05b0525f2153dce693f3eb3166697a"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/8dc8f3f4c2382fb7d1b1986ba8f33a2466cd3d7a"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/b983a35dad3701399c692d7c6eb57d8b6ffc0929"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/bbebc39a70f6fc9b02637c8624349e30325873cb"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}

CVE-2026-68262 (GCVE-0-2026-68262)

Vulnerability from cvelistv5 – Published: 2026-08-10 12:01 – Updated: 2026-08-17 05:01

Title

drm/imagination: Fix user array stride in pvr_set_uobj_array()

Summary

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Assigner

Linux mitre root

References

4 references

URL	Tags
https://git.kernel.org/stable/c/bbebc39a70f6fc9b0…
https://git.kernel.org/stable/c/b983a35dad3701399…
https://git.kernel.org/stable/c/09beaf4aec05b0525…
https://git.kernel.org/stable/c/8dc8f3f4c2382fb7d…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: f99f5f3ea7efd54ba0529c4f2d7c72712918a522 , < bbebc39a70f6fc9b02637c8624349e30325873cb (git) Affected: f99f5f3ea7efd54ba0529c4f2d7c72712918a522 , < b983a35dad3701399c692d7c6eb57d8b6ffc0929 (git) Affected: f99f5f3ea7efd54ba0529c4f2d7c72712918a522 , < 09beaf4aec05b0525f2153dce693f3eb3166697a (git) Affected: f99f5f3ea7efd54ba0529c4f2d7c72712918a522 , < 8dc8f3f4c2382fb7d1b1986ba8f33a2466cd3d7a (git)
Linux	Linux	Affected: 6.8 Unaffected: 0 , < 6.8 (semver) Unaffected: 6.12.101 , ≤ 6.12.* (semver) Unaffected: 6.18.42 , ≤ 6.18.* (semver) Unaffected: 7.1.6 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/imagination/pvr_drv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "bbebc39a70f6fc9b02637c8624349e30325873cb",
              "status": "affected",
              "version": "f99f5f3ea7efd54ba0529c4f2d7c72712918a522",
              "versionType": "git"
            },
            {
              "lessThan": "b983a35dad3701399c692d7c6eb57d8b6ffc0929",
              "status": "affected",
              "version": "f99f5f3ea7efd54ba0529c4f2d7c72712918a522",
              "versionType": "git"
            },
            {
              "lessThan": "09beaf4aec05b0525f2153dce693f3eb3166697a",
              "status": "affected",
              "version": "f99f5f3ea7efd54ba0529c4f2d7c72712918a522",
              "versionType": "git"
            },
            {
              "lessThan": "8dc8f3f4c2382fb7d1b1986ba8f33a2466cd3d7a",
              "status": "affected",
              "version": "f99f5f3ea7efd54ba0529c4f2d7c72712918a522",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/imagination/pvr_drv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/imagination: Fix user array stride in pvr_set_uobj_array()\n\npvr_set_uobj_array() copies an array of kernel objects to a userspace\narray whose element size is described by out-\u003estride. When out-\u003estride\nis different from the kernel object size, the slow path advances the\nuserspace pointer by the kernel object size and the kernel pointer by the\nuserspace stride.\n\nThis reverses the intended layout. For larger userspace strides, later\ncopies read from the wrong kernel addresses. For smaller userspace\nstrides, later copies are written at the wrong userspace offsets. The\npadding clear is also done only for the first element instead of the\npadding area for each element.\n\nAdvance the userspace pointer by out-\u003estride and the kernel pointer by\nobj_size, and clear per-element padding while the current userspace\npointer is still available."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached through the DRM_IOCTL_PVR_DEV_QUERY ioctl on the Imagination PowerVR render node (/dev/dri/renderD*), requiring local access to the device file; there is no remote or adjacent path.\nAC:L - The attacker fully controls the drm_pvr_obj_array stride and count fields passed to the ioctl, so the mis-advanced kernel pointer and the resulting out-of-bounds read occur deterministically on every call, with no race or unpredictable precondition.\nPR:L - The DEV_QUERY ioctl is marked DRM_RENDER_ALLOW, so it needs neither DRM master nor authentication - any unprivileged local user or sandboxed app that can open the render node (standard for GUI/Android/embedded graphics clients) can invoke it.\nUI:N - The attacking process triggers the flaw entirely on its own by issuing a single ioctl; no action by another user or victim process is needed.\nS:U - The out-of-bounds read and the disclosure occur within the kernel and are delivered to the calling process; no other security authority (VM, IOMMU domain) is crossed.\nC:H - With stride \u003e obj_size the kernel source pointer advances by the attacker-chosen stride (up to ~4 GiB) past the static_data_areas array, and copy_to_user hands 16 bytes per element back to userspace; repeating the ioctl with varying strides yields a repeatable read of arbitrary kernel memory at chosen offsets from a known symbol, leaking pointers, keys and other kernel data.\nI:N - Because min_stride equals the object size, only the stride \u003e obj_size case is reachable, so all userspace writes stay inside the caller\u0027s own count*stride buffer and no kernel memory is written; the only integrity effect is misplaced/uncleared data in the caller\u0027s own buffer.\nA:H - The kernel-side reads walk far outside the static array into unmapped, text or slab memory; with hardened usercopy or KASAN enabled this triggers usercopy_abort()/BUG and a KASAN out-of-bounds report, killing the task or panicking the system, and the fault is trivially repeatable."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:01:54.563Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/bbebc39a70f6fc9b02637c8624349e30325873cb"
        },
        {
          "url": "https://git.kernel.org/stable/c/b983a35dad3701399c692d7c6eb57d8b6ffc0929"
        },
        {
          "url": "https://git.kernel.org/stable/c/09beaf4aec05b0525f2153dce693f3eb3166697a"
        },
        {
          "url": "https://git.kernel.org/stable/c/8dc8f3f4c2382fb7d1b1986ba8f33a2466cd3d7a"
        }
      ],
      "title": "drm/imagination: Fix user array stride in pvr_set_uobj_array()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68262",
    "datePublished": "2026-08-10T12:01:36.582Z",
    "dateReserved": "2026-07-30T09:28:09.378Z",
    "dateUpdated": "2026-08-17T05:01:54.563Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

FKIE_CVE-2026-68262

CVE-2026-68262 (GCVE-0-2026-68262)

Tags

Sightings

Nomenclature