CVE-2026-68445drm/vc4: Prevent shader BO mappings from becoming writable
- 7.8HighCVSS base score
- 0.13%Exploitation in 30 daysEPSS · top 98% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Prevent shader BO mappings from becoming writable vc4_gem_object_mmap() rejects a writable mapping of a validated shader BO, but leaves VM_MAYWRITE set. Userspace can map the BO read-only and then turn it writable with mprotect(). Validated shader BOs must stay read-only: the validator checks the instructions once and the GPU trusts them afterwards. A writable mapping lets userspace rewrite the code after validation, bypassing the validator. Clear VM_MAYWRITE on the read-only path so the mapping cannot be upgraded, as i915 already does for its read-only objects.
Timeline
ID reserved
By Linux
- 13 days later
· 13 days later
Published
- 3 months later
· 3 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Received | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.13% · top 98% of all CVEs (12 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.
Affected products
- affected 463873d5701427f2964a0b4b72c45f1f14b6df87 – < 4c98260a967e8536c69437b8da8eea3188cd6db8
- affected 463873d5701427f2964a0b4b72c45f1f14b6df87 – < 9f0ee411fc2d76333d6087c5862ffa907cf7a175
- affected 463873d5701427f2964a0b4b72c45f1f14b6df87 – < 019e6ad247f7fd038d2e009789f6d9bfcccb1ae7
- affected 463873d5701427f2964a0b4b72c45f1f14b6df87 – < 6deaa317201851c644c431b57682e54d06b35838
- affected 463873d5701427f2964a0b4b72c45f1f14b6df87 – < fe168ef1d232d734d9998fd74822e2e20930dfff
- affected 463873d5701427f2964a0b4b72c45f1f14b6df87 – < 0c9e6367639548307d3f578f6943ce72c9d39087
- affected 4.5
- unaffected < 4.5
- unaffected 6.1.191 – ≤ 6.1.*
- unaffected 6.6.148 – ≤ 6.6.*
- unaffected 6.12.101 – ≤ 6.12.*
- unaffected 6.18.42 – ≤ 6.18.*
- unaffected 7.1.6 – ≤ 7.1.*
- unaffected 7.2 – ≤ *
References
References6
- https://git.kernel.org/stable/c/4c98260a967e8536c69437b8da8eea3188cd6db8 (opens in a new tab)
- https://git.kernel.org/stable/c/9f0ee411fc2d76333d6087c5862ffa907cf7a175 (opens in a new tab)
- https://git.kernel.org/stable/c/019e6ad247f7fd038d2e009789f6d9bfcccb1ae7 (opens in a new tab)
- https://git.kernel.org/stable/c/6deaa317201851c644c431b57682e54d06b35838 (opens in a new tab)
- https://git.kernel.org/stable/c/fe168ef1d232d734d9998fd74822e2e20930dfff (opens in a new tab)
- https://git.kernel.org/stable/c/0c9e6367639548307d3f578f6943ce72c9d39087 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-57020 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-68445)Record last updated .