Linux Kernel: DRM/VC4 BO Mapping Writable Escalation
CVE-2026-68445 Published on August 12, 2026
drm/vc4: Prevent shader BO mappings from becoming writable
In the Linux kernel, the following vulnerability has been resolved:
drm/vc4: Prevent shader BO mappings from becoming writable
vc4_gem_object_mmap() rejects a writable mapping of a validated shader
BO, but leaves VM_MAYWRITE set. Userspace can map the BO read-only and
then turn it writable with mprotect().
Validated shader BOs must stay read-only: the validator checks the
instructions once and the GPU trusts them afterwards. A writable
mapping lets userspace rewrite the code after validation, bypassing the
validator.
Clear VM_MAYWRITE on the read-only path so the mapping cannot be
upgraded, as i915 already does for its read-only objects.
Products Associated with CVE-2026-68445
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 463873d5701427f2964a0b4b72c45f1f14b6df87 and below 9f0ee411fc2d76333d6087c5862ffa907cf7a175 is affected.
- Version 463873d5701427f2964a0b4b72c45f1f14b6df87 and below 019e6ad247f7fd038d2e009789f6d9bfcccb1ae7 is affected.
- Version 463873d5701427f2964a0b4b72c45f1f14b6df87 and below 6deaa317201851c644c431b57682e54d06b35838 is affected.
- Version 463873d5701427f2964a0b4b72c45f1f14b6df87 and below fe168ef1d232d734d9998fd74822e2e20930dfff is affected.
- Version 463873d5701427f2964a0b4b72c45f1f14b6df87 and below 0c9e6367639548307d3f578f6943ce72c9d39087 is affected.
- Version 4.5 is affected.
- Before 4.5 is unaffected.
- Version 6.6.148, <= 6.6.* is unaffected.
- Version 6.12.101, <= 6.12.* is unaffected.
- Version 6.18.42, <= 6.18.* is unaffected.
- Version 7.1.6, <= 7.1.* is unaffected.
- Version 7.2-rc5, <= * is unaffected.