SB20260812283 - Incorrect calculation in Linux kernel drm imagination driver

Description

This security bulletin contains information about 1 vulnerability.

1) Incorrect calculation (CVE-ID: CVE-2026-68262)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information or corrupt memory in userspace.

The vulnerability exists due to improper pointer arithmetic in pvr_set_uobj_array() when copying an array of kernel objects to a userspace array with a differing element stride. A local user can supply crafted stride values to cause later copies to read from incorrect kernel addresses or write to incorrect userspace offsets to disclose sensitive information or corrupt memory in userspace.

The issue occurs in the slow path when the userspace element size differs from the kernel object size, and padding is not cleared for each element.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/09beaf4aec05b0525f2153dce693f3eb3166697a
• https://git.kernel.org/stable/c/8dc8f3f4c2382fb7d1b1986ba8f33a2466cd3d7a
• https://git.kernel.org/stable/c/b983a35dad3701399c692d7c6eb57d8b6ffc0929
• https://git.kernel.org/stable/c/bbebc39a70f6fc9b02637c8624349e30325873cb