CVE-2026-68262drm/imagination: Fix user array stride in pvr_set_uobj_array()
- 7.1HighCVSS base score
- 0.13%Exploitation in 30 daysEPSS · top 97% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Fix user array stride in pvr_set_uobj_array() pvr_set_uobj_array() copies an array of kernel objects to a userspace array whose element size is described by out->stride. When out->stride is different from the kernel object size, the slow path advances the userspace pointer by the kernel object size and the kernel pointer by the userspace stride. This reverses the intended layout. For larger userspace strides, later copies read from the wrong kernel addresses. For smaller userspace strides, later copies are written at the wrong userspace offsets. The padding clear is also done only for the first element instead of the padding area for each element. Advance the userspace pointer by out->stride and the kernel pointer by obj_size, and clear per-element padding while the current userspace pointer is still available.
Timeline
ID reserved
By Linux
- 11 days later
· 11 days later
Published
- 7 days later
· 7 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | High7.1 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H |
| NVDNVD · Received | 3.1 | High7.1 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H |
- EPSS (exploitation in 30 days)
- 0.13% · top 97% of all CVEs (13 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.1.
Affected products
- affected f99f5f3ea7efd54ba0529c4f2d7c72712918a522 – < bbebc39a70f6fc9b02637c8624349e30325873cb
- affected f99f5f3ea7efd54ba0529c4f2d7c72712918a522 – < b983a35dad3701399c692d7c6eb57d8b6ffc0929
- affected f99f5f3ea7efd54ba0529c4f2d7c72712918a522 – < 09beaf4aec05b0525f2153dce693f3eb3166697a
- affected f99f5f3ea7efd54ba0529c4f2d7c72712918a522 – < 8dc8f3f4c2382fb7d1b1986ba8f33a2466cd3d7a
- affected 6.8
- unaffected < 6.8
- unaffected 6.12.101 – ≤ 6.12.*
- unaffected 6.18.42 – ≤ 6.18.*
- unaffected 7.1.6 – ≤ 7.1.*
- unaffected 7.2 – ≤ *
References
References4
- https://git.kernel.org/stable/c/bbebc39a70f6fc9b02637c8624349e30325873cb (opens in a new tab)
- https://git.kernel.org/stable/c/b983a35dad3701399c692d7c6eb57d8b6ffc0929 (opens in a new tab)
- https://git.kernel.org/stable/c/09beaf4aec05b0525f2153dce693f3eb3166697a (opens in a new tab)
- https://git.kernel.org/stable/c/8dc8f3f4c2382fb7d1b1986ba8f33a2466cd3d7a (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-55363 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-68262)Record last updated .