{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-68262", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-30T09:28:09.378Z", "datePublished": "2026-08-10T12:01:36.582Z", "dateUpdated": "2026-08-10T12:01:36.582Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-10T12:01:36.582Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/imagination: Fix user array stride in pvr_set_uobj_array()\n\npvr_set_uobj_array() copies an array of kernel objects to a userspace\narray whose element size is described by out->stride. When out->stride\nis different from the kernel object size, the slow path advances the\nuserspace pointer by the kernel object size and the kernel pointer by the\nuserspace stride.\n\nThis reverses the intended layout. For larger userspace strides, later\ncopies read from the wrong kernel addresses. For smaller userspace\nstrides, later copies are written at the wrong userspace offsets. The\npadding clear is also done only for the first element instead of the\npadding area for each element.\n\nAdvance the userspace pointer by out->stride and the kernel pointer by\nobj_size, and clear per-element padding while the current userspace\npointer is still available."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/imagination/pvr_drv.c"], "versions": [{"version": "f99f5f3ea7efd54ba0529c4f2d7c72712918a522", "lessThan": "bbebc39a70f6fc9b02637c8624349e30325873cb", "status": "affected", "versionType": "git"}, {"version": "f99f5f3ea7efd54ba0529c4f2d7c72712918a522", "lessThan": "b983a35dad3701399c692d7c6eb57d8b6ffc0929", "status": "affected", "versionType": "git"}, {"version": "f99f5f3ea7efd54ba0529c4f2d7c72712918a522", "lessThan": "09beaf4aec05b0525f2153dce693f3eb3166697a", "status": "affected", "versionType": "git"}, {"version": "f99f5f3ea7efd54ba0529c4f2d7c72712918a522", "lessThan": "8dc8f3f4c2382fb7d1b1986ba8f33a2466cd3d7a", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/imagination/pvr_drv.c"], "versions": [{"version": "6.8", "status": "affected"}, {"version": "0", "lessThan": "6.8", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.101", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.42", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.6", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2-rc2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.12.101"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.18.42"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "7.1.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "7.2-rc2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/bbebc39a70f6fc9b02637c8624349e30325873cb"}, {"url": "https://git.kernel.org/stable/c/b983a35dad3701399c692d7c6eb57d8b6ffc0929"}, {"url": "https://git.kernel.org/stable/c/09beaf4aec05b0525f2153dce693f3eb3166697a"}, {"url": "https://git.kernel.org/stable/c/8dc8f3f4c2382fb7d1b1986ba8f33a2466cd3d7a"}], "title": "drm/imagination: Fix user array stride in pvr_set_uobj_array()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/imagination/pvr_drv.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "bbebc39a70f6fc9b02637c8624349e30325873cb", "status": "affected", "version": "f99f5f3ea7efd54ba0529c4f2d7c72712918a522", "versionType": "git"}, {"lessThan": "b983a35dad3701399c692d7c6eb57d8b6ffc0929", "status": "affected", "version": "f99f5f3ea7efd54ba0529c4f2d7c72712918a522", "versionType": "git"}, {"lessThan": "09beaf4aec05b0525f2153dce693f3eb3166697a", "status": "affected", "version": "f99f5f3ea7efd54ba0529c4f2d7c72712918a522", "versionType": "git"}, {"lessThan": "8dc8f3f4c2382fb7d1b1986ba8f33a2466cd3d7a", "status": "affected", "version": "f99f5f3ea7efd54ba0529c4f2d7c72712918a522", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/imagination/pvr_drv.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.8"}, {"lessThan": "6.8", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.101", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.42", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2-rc2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/imagination: Fix user array stride in pvr_set_uobj_array()\n\npvr_set_uobj_array() copies an array of kernel objects to a userspace\narray whose element size is described by out->stride. When out->stride\nis different from the kernel object size, the slow path advances the\nuserspace pointer by the kernel object size and the kernel pointer by the\nuserspace stride.\n\nThis reverses the intended layout. For larger userspace strides, later\ncopies read from the wrong kernel addresses. For smaller userspace\nstrides, later copies are written at the wrong userspace offsets. The\npadding clear is also done only for the first element instead of the\npadding area for each element.\n\nAdvance the userspace pointer by out->stride and the kernel pointer by\nobj_size, and clear per-element padding while the current userspace\npointer is still available."}], "id": "CVE-2026-68262", "lastModified": "2026-08-10T13:20:14.990", "metrics": {}, "published": "2026-08-10T13:20:14.990", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/09beaf4aec05b0525f2153dce693f3eb3166697a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8dc8f3f4c2382fb7d1b1986ba8f33a2466cd3d7a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b983a35dad3701399c692d7c6eb57d8b6ffc0929"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bbebc39a70f6fc9b02637c8624349e30325873cb"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Linux kernel: Memory corruption in drm/imagination", "id": "2513278", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513278"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ndrm/imagination: Fix user array stride in pvr_set_uobj_array()\npvr_set_uobj_array() copies an array of kernel objects to a userspace\narray whose element size is described by out->stride. When out->stride\nis different from the kernel object size, the slow path advances the\nuserspace pointer by the kernel object size and the kernel pointer by the\nuserspace stride.\nThis reverses the intended layout. For larger userspace strides, later\ncopies read from the wrong kernel addresses. For smaller userspace\nstrides, later copies are written at the wrong userspace offsets. The\npadding clear is also done only for the first element instead of the\npadding area for each element.\nAdvance the userspace pointer by out->stride and the kernel pointer by\nobj_size, and clear per-element padding while the current userspace\npointer is still available.", "A flaw was found in the Linux kernel. The `drm/imagination` component's `pvr_set_uobj_array()` function mishandles the user array stride during copies of kernel objects to a userspace array. This error causes incorrect memory access, leading to memory corruption where data is written to unintended locations, or information disclosure where sensitive kernel data is read from incorrect addresses. A local attacker could potentially leverage this to gain elevated privileges or cause a system crash (Denial of Service)."], "name": "CVE-2026-68262", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux_nvidia:", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux for NVIDIA 26"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "rhcos", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-08-10T12:01:36Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-68262\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-68262\nhttps://git.kernel.org/stable/c/09beaf4aec05b0525f2153dce693f3eb3166697a\nhttps://git.kernel.org/stable/c/8dc8f3f4c2382fb7d1b1986ba8f33a2466cd3d7a\nhttps://git.kernel.org/stable/c/b983a35dad3701399c692d7c6eb57d8b6ffc0929\nhttps://git.kernel.org/stable/c/bbebc39a70f6fc9b02637c8624349e30325873cb"], "threat_severity": "Moderate"}