CVE-2026-68474
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
In the Linux kernel's powerpc/spufs driver, there is an out-of-bounds access in spufs_mem_mmap_access(). The offset is checked against vm_end instead of the local store size, allowing access beyond the buffer.
Risk Assessment
A local attacker could access memory beyond the buffer, potentially leading to information leak or crash.
Recommendation
Install a kernel patch that rejects offsets >= LS_SIZE and clamps len to the remaining space.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access() spufs_mem_mmap_access() computes the local store offset as address - vma->vm_start, but bounds-checks it against vma->vm_end instead of the local store size. On 64-bit, offset is always well below vma->vm_end, so the clamp never fires and len stays unbounded against the LS_SIZE buffer returned by ctx->ops->get_ls(). Reject offsets at or beyond LS_SIZE and clamp len to the remaining space, mirroring the guard already used by spufs_mem_mmap_fault() and spufs_ps_fault().