{"id":"CVE-2026-68445","summary":"drm/vc4: Prevent shader BO mappings from becoming writable","details":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vc4: Prevent shader BO mappings from becoming writable\n\nvc4_gem_object_mmap() rejects a writable mapping of a validated shader\nBO, but leaves VM_MAYWRITE set.  Userspace can map the BO read-only and\nthen turn it writable with mprotect().\n\nValidated shader BOs must stay read-only: the validator checks the\ninstructions once and the GPU trusts them afterwards.  A writable\nmapping lets userspace rewrite the code after validation, bypassing the\nvalidator.\n\nClear VM_MAYWRITE on the read-only path so the mapping cannot be\nupgraded, as i915 already does for its read-only objects.","modified":"2026-08-13T04:02:57.525517407Z","published":"2026-08-12T00:07:36.230Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68445.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/019e6ad247f7fd038d2e009789f6d9bfcccb1ae7"},{"type":"WEB","url":"https://git.kernel.org/stable/c/0c9e6367639548307d3f578f6943ce72c9d39087"},{"type":"WEB","url":"https://git.kernel.org/stable/c/6deaa317201851c644c431b57682e54d06b35838"},{"type":"WEB","url":"https://git.kernel.org/stable/c/9f0ee411fc2d76333d6087c5862ffa907cf7a175"},{"type":"WEB","url":"https://git.kernel.org/stable/c/fe168ef1d232d734d9998fd74822e2e20930dfff"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68445.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68445"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"463873d5701427f2964a0b4b72c45f1f14b6df87"},{"fixed":"9f0ee411fc2d76333d6087c5862ffa907cf7a175"},{"fixed":"019e6ad247f7fd038d2e009789f6d9bfcccb1ae7"},{"fixed":"6deaa317201851c644c431b57682e54d06b35838"},{"fixed":"fe168ef1d232d734d9998fd74822e2e20930dfff"},{"fixed":"0c9e6367639548307d3f578f6943ce72c9d39087"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68445.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.0"},{"fixed":"6.6.148"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.101"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.42"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.1.6"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68445.json"}}],"schema_version":"1.9.0"}