CVE-2026-68445

Received Received - Intake

Memory Corruption in Linux Kernel DRM VC4 Driver

Publication date: 2026-08-12

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Prevent shader BO mappings from becoming writable vc4_gem_object_mmap() rejects a writable mapping of a validated shader BO, but leaves VM_MAYWRITE set. Userspace can map the BO read-only and then turn it writable with mprotect(). Validated shader BOs must stay read-only: the validator checks the instructions once and the GPU trusts them afterwards. A writable mapping lets userspace rewrite the code after validation, bypassing the validator. Clear VM_MAYWRITE on the read-only path so the mapping cannot be upgraded, as i915 already does for its read-only objects.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-17

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-30

NVD

CVE-2026-68445

EUVD

EUVD-2026-57020

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel allows userspace to bypass shader validation by making a read-only shader buffer object (BO) writable after mapping it. The kernel's drm/vc4 component fails to clear the VM_MAYWRITE flag, enabling userspace to use mprotect() to change the mapping permissions. This could let attackers modify validated GPU shader code, potentially executing arbitrary instructions on the GPU.

Detection Guidance

This vulnerability is specific to the Linux kernel's DRM/VC4 graphics driver. Detection requires checking kernel version and driver behavior. Inspect kernel logs for VC4-related errors or unusual shader BO mappings. No direct network detection commands are applicable.

Impact Analysis

If exploited, this vulnerability could allow an attacker with local access to execute arbitrary code on the GPU, potentially leading to system instability, data leaks, or privilege escalation. It primarily affects systems using the vc4 graphics driver, common in Raspberry Pi devices and other ARM-based Linux systems.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a low-level Linux kernel memory mapping issue. Compliance impacts would depend on how the vulnerability is exploited in a specific system or application context, which is not detailed here.

Mitigation Strategies

Update to a patched Linux kernel version that includes the fix for CVE-2026-68445. If immediate patching is not possible, restrict access to GPU shader functionality or disable the VC4 driver if unused. Monitor kernel security advisories for updates.

Hi! I’m here to help you understand CVE-2026-68445. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70