Look up another CVE · open CVE-2026-68262 in the interactive tracker
CVE-2026-68262
drm/imagination: Fix user array stride in pvr_set_uobj_array()
Published 2026-08-10 (2 months ago) by the Linux kernel CNA. Subsystem drivers/gpu. Debian urgency: unimportant.
What to do, per Debian release
Debian's own status for CVE-2026-68262 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | not affected | 6.1.190-1 | Nothing to do. bookworm never shipped the vulnerable code. |
| Debian 13trixie | fixed | 6.12.101-1 | Update the kernel and reboot. Fixed in 6.12.101-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.6-1 | Update the kernel and reboot. Fixed in 7.1.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.6-1 | Update the kernel and reboot. Fixed in 7.1.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4745-1 · 2026-08-18 · text | 6.12.101-1~deb12u1 | Update the kernel and reboot. DLA-4745-1 shipped the fix on 2026-08-18, in 6.12.101-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
pvr_set_uobj_array() copies an array of kernel objects to a userspace array whose element size is described by out->stride. When out->stride is different from the kernel object size, the slow path advances the userspace pointer by the kernel object size and the kernel pointer by the userspace stride. This reverses the intended layout. For larger userspace strides, later copies read from the wrong kernel addresses. For smaller userspace strides, later copies are written at the wrong userspace offsets. The padding clear is also done only for the first element instead of the padding area for each element. Advance the userspace pointer by out->stride and the kernel pointer by obj_size, and clear per-element padding while the current userspace pointer is still available.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/gpu/drm/imagination/pvr_drv.c
- What this is
- IMGTEC POWERVR DRM DRIVERMAINTAINERS section matched on drivers/gpu/drm/imagination/ · Supported
- Kernel module
- powervr
Check it on the machine
grep -w CONFIG_DRM_POWERVR /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w powervrPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian does not build this code in 2 releases. It does build it in 2 releases, so the answer depends on which release the machine runs. The build rule could not be established for 1 release, so nothing is claimed about those.
- bookworm?
- trixien
- forky, sidMnot built on amd64/amd64, amd64/cloud-amd64, amd64/rt-amd64, arm64/arm64, arm64/arm64-16k, arm64/cloud-arm64, arm64/rt-arm64, armhf/armmp, armhf/armmp-lpae, loong64/loong64, ppc64el/powerpc64le, ppc64el/powerpc64le-64k, s390x/s390x
- bookworm · linux-6.12n
- ?
- not established - no Makefile entry for the affected file
- n
- not enabled on any flavour - this release does not build the code
- M
- a module where it is built at all; some flavours do not build it
Where a release above reads "not established", no build rule for the affected file was found in that release's kernel tree. That is a gap in this lookup, not a finding that the code is absent.
- Build switch
- CONFIG_DRM_POWERVR
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-08-10 (2 months ago)source
- CVSS
- 7.1 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.13%, higher than 2.4% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- drivers/gpu
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 6.8 | 6.12.101 | bbebc39a70f6 |
| 6.8 | 6.18.42 | b983a35dad37 |
| 6.8 | 7.1.6 | 09beaf4aec05 |
| 6.8 | 7.2 | 8dc8f3f4c238 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4745-1 | 2026-08-18 | bookworm 6.12.101-1~deb12u1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The bug is reached through the DRM_IOCTL_PVR_DEV_QUERY ioctl on the Imagination PowerVR render node (/dev/dri/renderD*), requiring local access to the device file; there is no remote or adjacent path.
- AC:LAttack complexity, low
- The attacker fully controls the drm_pvr_obj_array stride and count fields passed to the ioctl, so the mis-advanced kernel pointer and the resulting out-of-bounds read occur deterministically on every call, with no race or unpredictable precondition.
- PR:LPrivileges required, low
- The DEV_QUERY ioctl is marked DRM_RENDER_ALLOW, so it needs neither DRM master nor authentication - any unprivileged local user or sandboxed app that can open the render node (standard for GUI/Android/embedded graphics clients) can invoke it.
- UI:NUser interaction, none
- The attacking process triggers the flaw entirely on its own by issuing a single ioctl; no action by another user or victim process is needed.
- S:UScope, unchanged
- The out-of-bounds read and the disclosure occur within the kernel and are delivered to the calling process; no other security authority (VM, IOMMU domain) is crossed.
- C:HConfidentiality impact, high
- With stride > obj_size the kernel source pointer advances by the attacker-chosen stride (up to ~4 GiB) past the static_data_areas array, and copy_to_user hands 16 bytes per element back to userspace; repeating the ioctl with varying strides yields a repeatable read of arbitrary kernel memory at chosen offsets from a known symbol, leaking pointers, keys and other kernel data.
- I:NIntegrity impact, none
- Because min_stride equals the object size, only the stride > obj_size case is reachable, so all userspace writes stay inside the caller's own count*stride buffer and no kernel memory is written; the only integrity effect is misplaced/uncleared data in the caller's own buffer.
- A:HAvailability impact, high
- The kernel-side reads walk far outside the static array into unmapped, text or slab memory; with hardened usercopy or KASAN enabled this triggers usercopy_abort()/BUG and a KASAN out-of-bounds report, killing the task or panicking the system, and the fault is trivially repeatable.