Bug 2514448 (CVE-2026-68445)

Summary: CVE-2026-68445 kernel: drm/vc4: Prevent shader BO mappings from becoming writable
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Linux kernel's `drm/vc4` component. This vulnerability allows a local user to bypass security validation for shader code. By manipulating memory permissions, an attacker could modify shader instructions after they have been deemed safe, potentially leading to unauthorized code execution.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-12 00:21:59 UTC 
In the Linux kernel, the following vulnerability has been resolved:

drm/vc4: Prevent shader BO mappings from becoming writable

vc4_gem_object_mmap() rejects a writable mapping of a validated shader
BO, but leaves VM_MAYWRITE set.  Userspace can map the BO read-only and
then turn it writable with mprotect().

Validated shader BOs must stay read-only: the validator checks the
instructions once and the GPU trusts them afterwards.  A writable
mapping lets userspace rewrite the code after validation, bypassing the
validator.

Clear VM_MAYWRITE on the read-only path so the mapping cannot be
upgraded, as i915 already does for its read-only objects.
Comment 1 Mauro Matteo Cascella 2026-08-12 15:19:06 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026081257-CVE-2026-68445-00a0@gregkh/T