CVE-2026-68445 (GCVE-0-2026-68445)

Vulnerability from cvelistv5 – Published: 2026-08-12 00:07 – Updated: 2026-08-17 05:05
VLAI
Title
drm/vc4: Prevent shader BO mappings from becoming writable
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Prevent shader BO mappings from becoming writable vc4_gem_object_mmap() rejects a writable mapping of a validated shader BO, but leaves VM_MAYWRITE set. Userspace can map the BO read-only and then turn it writable with mprotect(). Validated shader BOs must stay read-only: the validator checks the instructions once and the GPU trusts them afterwards. A writable mapping lets userspace rewrite the code after validation, bypassing the validator. Clear VM_MAYWRITE on the read-only path so the mapping cannot be upgraded, as i915 already does for its read-only objects.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 463873d5701427f2964a0b4b72c45f1f14b6df87 , < 9f0ee411fc2d76333d6087c5862ffa907cf7a175 (git)
Affected: 463873d5701427f2964a0b4b72c45f1f14b6df87 , < 019e6ad247f7fd038d2e009789f6d9bfcccb1ae7 (git)
Affected: 463873d5701427f2964a0b4b72c45f1f14b6df87 , < 6deaa317201851c644c431b57682e54d06b35838 (git)
Affected: 463873d5701427f2964a0b4b72c45f1f14b6df87 , < fe168ef1d232d734d9998fd74822e2e20930dfff (git)
Affected: 463873d5701427f2964a0b4b72c45f1f14b6df87 , < 0c9e6367639548307d3f578f6943ce72c9d39087 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.5
Unaffected: 0 , < 4.5 (semver)
Unaffected: 6.6.148 , ≤ 6.6.* (semver)
Unaffected: 6.12.101 , ≤ 6.12.* (semver)
Unaffected: 6.18.42 , ≤ 6.18.* (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/vc4/vc4_bo.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9f0ee411fc2d76333d6087c5862ffa907cf7a175",
              "status": "affected",
              "version": "463873d5701427f2964a0b4b72c45f1f14b6df87",
              "versionType": "git"
            },
            {
              "lessThan": "019e6ad247f7fd038d2e009789f6d9bfcccb1ae7",
              "status": "affected",
              "version": "463873d5701427f2964a0b4b72c45f1f14b6df87",
              "versionType": "git"
            },
            {
              "lessThan": "6deaa317201851c644c431b57682e54d06b35838",
              "status": "affected",
              "version": "463873d5701427f2964a0b4b72c45f1f14b6df87",
              "versionType": "git"
            },
            {
              "lessThan": "fe168ef1d232d734d9998fd74822e2e20930dfff",
              "status": "affected",
              "version": "463873d5701427f2964a0b4b72c45f1f14b6df87",
              "versionType": "git"
            },
            {
              "lessThan": "0c9e6367639548307d3f578f6943ce72c9d39087",
              "status": "affected",
              "version": "463873d5701427f2964a0b4b72c45f1f14b6df87",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/vc4/vc4_bo.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.5"
            },
            {
              "lessThan": "4.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "4.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "4.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "4.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "4.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vc4: Prevent shader BO mappings from becoming writable\n\nvc4_gem_object_mmap() rejects a writable mapping of a validated shader\nBO, but leaves VM_MAYWRITE set.  Userspace can map the BO read-only and\nthen turn it writable with mprotect().\n\nValidated shader BOs must stay read-only: the validator checks the\ninstructions once and the GPU trusts them afterwards.  A writable\nmapping lets userspace rewrite the code after validation, bypassing the\nvalidator.\n\nClear VM_MAYWRITE on the read-only path so the mapping cannot be\nupgraded, as i915 already does for its read-only objects."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local access to the vc4 DRM render node (/dev/dri/renderD*) to issue VC4_CREATE_SHADER_BO, VC4_MMAP_BO, mmap/mprotect and VC4_SUBMIT_CL; there is no remote or network-facing path to this code.\nAC:L - The attacker fully controls every step: create a shader that passes validation, map it PROT_READ, upgrade it with mprotect(PROT_WRITE), rewrite the instructions and submit. There is no race, no memory-layout dependency, and it works on the default configuration of any VC4 (Raspberry Pi) system.\nPR:L - VC4_CREATE_SHADER_BO, VC4_MMAP_BO and VC4_SUBMIT_CL are all DRM_RENDER_ALLOW ioctls, so an ordinary unprivileged user with render-node access (the default for logged-in/graphical users on Raspberry Pi and embedded VC4 devices) can perform the whole sequence. No capability check is involved.\nUI:N - The attacking process performs the entire sequence itself; no action by another user or administrator is needed.\nS:U - The vulnerable driver and the compromised resource (kernel/system memory) are both under the kernel\u0027s security authority; this is a standard local kernel privilege escalation rather than a VM or hypervisor boundary escape.\nC:H - Post-validation rewriting of shader code lets the GPU, which has no IOMMU on VC4, read arbitrary system memory via texture, uniform and direct-addressed TMU lookups \u2014 exactly the disclosure the validator exists to prevent, giving arbitrary kernel memory read.\nI:H - Unvalidated QPU code can use the VPM write address register in general-purpose DMA mode to write to arbitrary physical addresses, an arbitrary kernel-memory write primitive that yields full privilege escalation and code execution.\nA:H - The same arbitrary DMA writes and unbounded shader execution readily corrupt kernel structures or hang the GPU, causing kernel panics or a full system hang triggerable at will by an unprivileged user."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:05:42.989Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9f0ee411fc2d76333d6087c5862ffa907cf7a175"
        },
        {
          "url": "https://git.kernel.org/stable/c/019e6ad247f7fd038d2e009789f6d9bfcccb1ae7"
        },
        {
          "url": "https://git.kernel.org/stable/c/6deaa317201851c644c431b57682e54d06b35838"
        },
        {
          "url": "https://git.kernel.org/stable/c/fe168ef1d232d734d9998fd74822e2e20930dfff"
        },
        {
          "url": "https://git.kernel.org/stable/c/0c9e6367639548307d3f578f6943ce72c9d39087"
        }
      ],
      "title": "drm/vc4: Prevent shader BO mappings from becoming writable",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68445",
    "datePublished": "2026-08-12T00:07:36.230Z",
    "dateReserved": "2026-07-30T09:28:09.394Z",
    "dateUpdated": "2026-08-17T05:05:42.989Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68445",
      "date": "2026-09-22",
      "epss": "0.00126",
      "percentile": "0.02662"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/vc4/vc4_bo.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "9f0ee411fc2d76333d6087c5862ffa907cf7a175",
                    "status": "affected",
                    "version": "463873d5701427f2964a0b4b72c45f1f14b6df87",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "019e6ad247f7fd038d2e009789f6d9bfcccb1ae7",
                    "status": "affected",
                    "version": "463873d5701427f2964a0b4b72c45f1f14b6df87",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6deaa317201851c644c431b57682e54d06b35838",
                    "status": "affected",
                    "version": "463873d5701427f2964a0b4b72c45f1f14b6df87",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "fe168ef1d232d734d9998fd74822e2e20930dfff",
                    "status": "affected",
                    "version": "463873d5701427f2964a0b4b72c45f1f14b6df87",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0c9e6367639548307d3f578f6943ce72c9d39087",
                    "status": "affected",
                    "version": "463873d5701427f2964a0b4b72c45f1f14b6df87",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/vc4/vc4_bo.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.5"
                  },
                  {
                    "lessThan": "4.5",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.148",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.101",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.42",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vc4: Prevent shader BO mappings from becoming writable\n\nvc4_gem_object_mmap() rejects a writable mapping of a validated shader\nBO, but leaves VM_MAYWRITE set.  Userspace can map the BO read-only and\nthen turn it writable with mprotect().\n\nValidated shader BOs must stay read-only: the validator checks the\ninstructions once and the GPU trusts them afterwards.  A writable\nmapping lets userspace rewrite the code after validation, bypassing the\nvalidator.\n\nClear VM_MAYWRITE on the read-only path so the mapping cannot be\nupgraded, as i915 already does for its read-only objects."
          }
        ],
        "id": "CVE-2026-68445",
        "lastModified": "2026-08-17T06:17:53.560",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-12T00:17:44.860",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/019e6ad247f7fd038d2e009789f6d9bfcccb1ae7"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0c9e6367639548307d3f578f6943ce72c9d39087"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6deaa317201851c644c431b57682e54d06b35838"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9f0ee411fc2d76333d6087c5862ffa907cf7a175"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/fe168ef1d232d734d9998fd74822e2e20930dfff"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-31T11:14:10+00:00",
      "cve": "CVE-2026-68445",
      "id": "CVE-2026-68445",
      "initial_release_date": "2026-08-12T00:00:00+00:00",
      "product_status:known_affected": "157",
      "product_status:known_not_affected": "120",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/vc4: Prevent shader BO mappings from becoming writable",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68445.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-18T00:29:59Z",
      "cve": "CVE-2026-68445",
      "id": "CVE-2026-68445",
      "initial_release_date": "2026-08-12T16:21:47Z",
      "product_status:known_affected": "522",
      "product_status:known_not_affected": "226",
      "product_status:recommended": "107",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-68445",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-68445.json",
      "version": "11"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.