Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-68474— powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access()

AI Predicted 7.8 Difficulty: Moderate EPSS 0.21% · P12

Possible ATT&CK Techniques 1AI

T1206

Affected Version Matrix 18

VendorProductVersion RangeStatus
LinuxLinuxa352894d07059649398c4769dc8b645e1a1dad88< aa7aa8ba40c089762d821e3987aaae19e1f5705caffected
a352894d07059649398c4769dc8b645e1a1dad88< d479a7711f8ff127946467b910d947bd971b94edaffected
a352894d07059649398c4769dc8b645e1a1dad88< 9d3569bfdceda69d5ffd5148901e57b69954d9efaffected
a352894d07059649398c4769dc8b645e1a1dad88< d97a8f3668949a8a9d1f6202f8c53446f2d89aa7affected
a352894d07059649398c4769dc8b645e1a1dad88< 913feef74354c653f10ecd4631df7618a95c49c2affected
a352894d07059649398c4769dc8b645e1a1dad88< 3c1e92f75e11a11492b8cb901fceeb9f16ae6415affected
a352894d07059649398c4769dc8b645e1a1dad88< 4efa313b15925bdd864784865d6585174979294baffected
a352894d07059649398c4769dc8b645e1a1dad88< 47b87f469a35b5ffc81c16eee6b13a9b6c8d55c6affected
… +10 more rows
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2026-68474

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access() spufs_mem_mmap_access() computes the local store offset as address - vma->vm_start, but bounds-checks it against vma->vm_end instead of the local store size. On 64-bit, offset is always well below vma->vm_end, so the clamp never fires and len stays unbounded against the LS_SIZE buffer returned by ctx->ops->get_ls(). Reject offsets at or beyond LS_SIZE and clamp len to the remaining space, mirroring the guard already used by spufs_mem_mmap_fault() and spufs_ps_fault().
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

VendorProductAffected VersionsCPESubscribe
LinuxLinux a352894d07059649398c4769dc8b645e1a1dad88 ~ aa7aa8ba40c089762d821e3987aaae19e1f5705c -
LinuxLinux 2.6.27 -

II. Public POCs for CVE-2026-68474

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-68474

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-68474 (8)

Same Patch Batch · Linux · 2026-08-15 · 848 CVEs total

CVE-2026-72257ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback
CVE-2026-72269fbdev: uvesafb: fix potential memory leak in uvesafb_probe()
CVE-2026-72268fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe()
CVE-2026-72267fbdev: carminefb: fix potential memory leak in alloc_carmine_fb()
CVE-2026-72266fbdev: vesafb: fix memory leak in vesafb_probe()
CVE-2026-72265fbdev: nvidia: fix potential memory leak in nvidiafb_probe()
CVE-2026-72264fbdev: tridentfb: fix potential memory leak in trident_pci_probe()
CVE-2026-72262ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get
CVE-2026-72263ASoC: SOF: topology: fix memory leak in snd_sof_load_topology
CVE-2026-72261ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control
CVE-2026-72260ASoC: mediatek: mt8192: Check runtime resume during probe
CVE-2026-72259ASoC: mediatek: mt8192: Release reserved memory on cleanup
CVE-2026-72258ASoC: mediatek: mt8183: Release reserved memory on cleanup
CVE-2026-72256netfilter: xt_cluster: reject template conntracks in hash match
CVE-2026-72246netfilter: flowtable: use correct direction to set up tunnel route
CVE-2026-72249netfilter: flowtable: use dst in this direction when pushing IPIP header
CVE-2026-72248netfilter: flowtable: support IPIP tunnel with direct xmit
CVE-2026-72247netfilter: nf_conncount: fix zone comparison in tuple dedup
CVE-2026-72250netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag
CVE-2026-72245gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path

Showing top 20 of 848 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-68474

No comments yet

Leave a comment