Look up another CVE · open CVE-2026-68474 in the interactive tracker
CVE-2026-68474
powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access()
Published 2026-08-15 (2 months ago) by the Linux kernel CNA. Subsystem arch/powerpc. Debian urgency: not yet assigned.
Debian does not build this code. The per-release build detail is under "Where it lives" below.
What to do, per Debian release
Debian's own status for CVE-2026-68474 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixed | 6.1.180-1 | Update the kernel and reboot. Fixed in 6.1.180-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixed | 6.12.100-1 | Update the kernel and reboot. Fixed in 6.12.100-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
spufs_mem_mmap_access() computes the local store offset as address - vma->vm_start, but bounds-checks it against vma->vm_end instead of the local store size. On 64-bit, offset is always well below vma->vm_end, so the clamp never fires and len stays unbounded against the LS_SIZE buffer returned by ctx->ops->get_ls(). Reject offsets at or beyond LS_SIZE and clamp len to the remaining space, mirroring the guard already used by spufs_mem_mmap_fault() and spufs_ps_fault().
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
arch/powerpc/platforms/cell/spufs/file.c
- What this is
- SPU FILE SYSTEMMAINTAINERS section matched on arch/powerpc/platforms/cell/spufs/ · linuxppc-dev@lists.ozlabs.org · Orphan
- Kernel module
- none to look for. The file would have gone into spufs, and Debian does not compile it into that module, so finding spufs in lsmod would say nothing about this CVE.
Check it on the machine
grep -wE 'CONFIG_PPC_CELL|CONFIG_SPU_BASE|CONFIG_SPU_FS' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian does not build this code. In 4 releases below, every kernel flavour Debian publishes has the switch off, so the vulnerable file is compiled into no kernel binary Debian ships.
- bookworm, trixie, forky, sidn
- n
- not enabled on any flavour - this release does not build the code
- Build switches
- CONFIG_PPC_CELL, CONFIG_SPU_BASE, CONFIG_SPU_FS
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-08-15 (2 months ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.16%, higher than 5.2% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- arch/powerpc
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 2.6.27 | 5.10.261 | aa7aa8ba40c0 |
| 2.6.27 | 5.15.212 | d479a7711f8f |
| 2.6.27 | 6.1.178 | 9d3569bfdced |
| 2.6.27 | 6.6.145 | d97a8f366894 |
| 2.6.27 | 6.12.97 | 913feef74354 |
| 2.6.27 | 6.18.40 | 3c1e92f75e11 |
| 2.6.27 | 7.1.5 | 4efa313b1592 |
| 2.6.27 | 7.2 | 47b87f469a35 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The bug is reached only through local kernel interfaces (spu_create, mmap of spufs "mem", then /proc/self/mem or ptrace/GDB via access_remote_vm); there is no network, adjacent-radio, or physical-device attack path.
- AC:LAttack complexity, low
- An attacker who can map spufs local store fully controls the VMA address and transfer length; the broken bounds check fails deterministically on 64-bit, so no races or victim-specific layout are required.
- PR:LPrivileges required, low
- On Cell systems with spufs mounted, spu_create and the world-readable/writable mem node (0666) require only a local unprivileged account with write access to the spufs mount, not real init-namespace root or non-namespace capabilities.
- UI:NUser interaction, none
- Exploitation is self-contained: the attacker creates/maps their own SPU context and triggers the flaw through /proc/self/mem or debugging APIs without any separate victim action.
- S:UScope, unchanged
- Impact is kernel memory corruption and disclosure within the host kernel from a local user context; it does not cross a VM, container, or IOMMU security boundary to another authority.
- C:HConfidentiality impact, high
- memcpy_fromio with an unclamped length reads well past the 256KB LS_SIZE buffer (vmalloc heap after lscsa or beyond the ioremap), enabling substantial out-of-bounds kernel memory disclosure.
- I:HIntegrity impact, high
- memcpy_toio with the same faulty bounds allows out-of-bounds writes past the local-store mapping, corrupting adjacent kernel memory and supporting further privilege escalation or code execution.
- A:HAvailability impact, high
- Out-of-bounds MMIO/vmalloc access can provoke immediate kernel faults/oops/panics, and heap corruption from oversized writes can crash or hang the system during exploitation.