CVE-2026-68262: drm/imagination: Fix user array stride in pvr_set_uobj_array()

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

drm/imagination: Fix user array stride in pvr_set_uobj_array()

pvr_set_uobj_array() copies an array of kernel objects to a userspace
array whose element size is described by out->stride. When out->stride
is different from the kernel object size, the slow path advances the
userspace pointer by the kernel object size and the kernel pointer by the
userspace stride.

This reverses the intended layout. For larger userspace strides, later
copies read from the wrong kernel addresses. For smaller userspace
strides, later copies are written at the wrong userspace offsets. The
padding clear is also done only for the first element instead of the
padding area for each element.

Advance the userspace pointer by out->stride and the kernel pointer by
obj_size, and clear per-element padding while the current userspace
pointer is still available.

The Linux kernel CVE team has assigned CVE-2026-68262 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.8 with commit f99f5f3ea7efd54ba0529c4f2d7c72712918a522 and fixed in 6.12.101 with commit bbebc39a70f6fc9b02637c8624349e30325873cb
	Issue introduced in 6.8 with commit f99f5f3ea7efd54ba0529c4f2d7c72712918a522 and fixed in 6.18.42 with commit b983a35dad3701399c692d7c6eb57d8b6ffc0929
	Issue introduced in 6.8 with commit f99f5f3ea7efd54ba0529c4f2d7c72712918a522 and fixed in 7.1.6 with commit 09beaf4aec05b0525f2153dce693f3eb3166697a
	Issue introduced in 6.8 with commit f99f5f3ea7efd54ba0529c4f2d7c72712918a522 and fixed in 7.2-rc2 with commit 8dc8f3f4c2382fb7d1b1986ba8f33a2466cd3d7a

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-68262
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/gpu/drm/imagination/pvr_drv.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/bbebc39a70f6fc9b02637c8624349e30325873cb
	https://git.kernel.org/stable/c/b983a35dad3701399c692d7c6eb57d8b6ffc0929
	https://git.kernel.org/stable/c/09beaf4aec05b0525f2153dce693f3eb3166697a
	https://git.kernel.org/stable/c/8dc8f3f4c2382fb7d1b1986ba8f33a2466cd3d7a