Cloudanix VulnDB

CVE-2026-68262

High · 7.1

CVSS

7.1

EPSS

0.1%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in how the Linux kernel handles certain graphics operations on Imagination GPUs can let a logged-in user read or write memory they should not access, potentially crashing the system or gaining higher privileges.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Data Exposure
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Incorrect pointer advancement in pvr_set_uobj_array causes reads from wrong kernel addresses for oversized user strides and writes to incorrect userspace offsets for undersized strides, plus incomplete per-element padding clears, resulting in memory corruption.

Why it matters to the business

Systems using Imagination GPUs on Linux may experience crashes, unexpected behavior, or local privilege escalation that disrupts operations and requires urgent patching.

How an attack unfolds

A local attacker invokes the affected DRM ioctl path with a crafted userspace object array descriptor whose stride differs from the kernel object size, triggering the reversed pointer math and corrupted copies that an attacker can leverage for further memory manipulation.

How to fix it

Apply the upstream kernel commit that corrects pointer advancement to use out->stride for userspace and obj_size for kernel pointers while clearing padding per element; rebuild and deploy the fixed kernel on all affected systems.

How to confirm the fix worked

Confirm the corrected pointer arithmetic and per-element padding logic are present in the pvr_set_uobj_array function after patching; test with stride-mismatched array copies to verify no out-of-bounds accesses occur.

Typical attack path

  1. Obtain local unprivileged access on a Linux system with Imagination GPU support enabled
  2. Invoke the DRM userspace interface with a maliciously sized stride value in the object array descriptor
  3. Trigger repeated element copies that read or write outside intended bounds
  4. Leverage resulting memory corruption for information disclosure or privilege escalation

How to detect it

Review kernel logs and audit trails for unusual DRM ioctl activity or crashes originating from the pvr driver; no specific post-exploitation artifacts are publicly documented for this issue.

What your security team should do

  • Prioritize kernel updates on all systems exposing the Imagination DRM driver
  • Restrict unprivileged access to GPU device nodes until patches are applied
  • Monitor kernel update channels for the Imagination driver fix

The record

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Fix user array stride in pvr_set_uobj_array() pvr_set_uobj_array() copies an array of kernel objects to a userspace array whose element size is described by out->stride. When out->stride is different from the kernel object size, the slow path advances the userspace pointer by the kernel object size and the kernel pointer by the userspace stride. This reverses the intended layout. For larger userspace strides, later copies read from the wrong kernel addresses. For smaller userspace strides, later copies are written at the wrong userspace offsets. The padding clear is also done only for the first element instead of the padding area for each element. Advance the userspace pointer by out->stride and the kernel pointer by obj_size, and clear per-element padding while the current userspace pointer is still available.

Affected packages

Ecosystem Package Introduced Fixed