CVE-2026-68474: powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access()

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access()

spufs_mem_mmap_access() computes the local store offset as
address - vma->vm_start, but bounds-checks it against vma->vm_end
instead of the local store size. On 64-bit, offset is always well
below vma->vm_end, so the clamp never fires and len stays unbounded
against the LS_SIZE buffer returned by ctx->ops->get_ls().

Reject offsets at or beyond LS_SIZE and clamp len to the remaining
space, mirroring the guard already used by spufs_mem_mmap_fault() and
spufs_ps_fault().

The Linux kernel CVE team has assigned CVE-2026-68474 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 2.6.27 with commit a352894d07059649398c4769dc8b645e1a1dad88 and fixed in 5.10.261 with commit aa7aa8ba40c089762d821e3987aaae19e1f5705c
	Issue introduced in 2.6.27 with commit a352894d07059649398c4769dc8b645e1a1dad88 and fixed in 5.15.212 with commit d479a7711f8ff127946467b910d947bd971b94ed
	Issue introduced in 2.6.27 with commit a352894d07059649398c4769dc8b645e1a1dad88 and fixed in 6.1.178 with commit 9d3569bfdceda69d5ffd5148901e57b69954d9ef
	Issue introduced in 2.6.27 with commit a352894d07059649398c4769dc8b645e1a1dad88 and fixed in 6.6.145 with commit d97a8f3668949a8a9d1f6202f8c53446f2d89aa7
	Issue introduced in 2.6.27 with commit a352894d07059649398c4769dc8b645e1a1dad88 and fixed in 6.12.97 with commit 913feef74354c653f10ecd4631df7618a95c49c2
	Issue introduced in 2.6.27 with commit a352894d07059649398c4769dc8b645e1a1dad88 and fixed in 6.18.40 with commit 3c1e92f75e11a11492b8cb901fceeb9f16ae6415
	Issue introduced in 2.6.27 with commit a352894d07059649398c4769dc8b645e1a1dad88 and fixed in 7.1.5 with commit 4efa313b15925bdd864784865d6585174979294b
	Issue introduced in 2.6.27 with commit a352894d07059649398c4769dc8b645e1a1dad88 and fixed in 7.2-rc4 with commit 47b87f469a35b5ffc81c16eee6b13a9b6c8d55c6

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-68474
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	arch/powerpc/platforms/cell/spufs/file.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/aa7aa8ba40c089762d821e3987aaae19e1f5705c
	https://git.kernel.org/stable/c/d479a7711f8ff127946467b910d947bd971b94ed
	https://git.kernel.org/stable/c/9d3569bfdceda69d5ffd5148901e57b69954d9ef
	https://git.kernel.org/stable/c/d97a8f3668949a8a9d1f6202f8c53446f2d89aa7
	https://git.kernel.org/stable/c/913feef74354c653f10ecd4631df7618a95c49c2
	https://git.kernel.org/stable/c/3c1e92f75e11a11492b8cb901fceeb9f16ae6415
	https://git.kernel.org/stable/c/4efa313b15925bdd864784865d6585174979294b
	https://git.kernel.org/stable/c/47b87f469a35b5ffc81c16eee6b13a9b6c8d55c6