---
id: CVE-2026-68445
title: 'drm/vc4: Prevent shader BO mappings from becoming writable'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/vc4: Prevent shader BO mappings from becoming writable

  vc4_gem_object_mmap() rejects a writable mapping of a validated shader
  BO, but leaves VM_MAYWRITE set.  User…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 463873d5701427f2964a0b4b72c45f1f14b6df87 <
    4c98260a967e8536c69437b8da8eea3188cd6db8
  - >-
    Linux >= 463873d5701427f2964a0b4b72c45f1f14b6df87 <
    9f0ee411fc2d76333d6087c5862ffa907cf7a175
  - >-
    Linux >= 463873d5701427f2964a0b4b72c45f1f14b6df87 <
    019e6ad247f7fd038d2e009789f6d9bfcccb1ae7
  - >-
    Linux >= 463873d5701427f2964a0b4b72c45f1f14b6df87 <
    6deaa317201851c644c431b57682e54d06b35838
  - >-
    Linux >= 463873d5701427f2964a0b4b72c45f1f14b6df87 <
    fe168ef1d232d734d9998fd74822e2e20930dfff
  - >-
    Linux >= 463873d5701427f2964a0b4b72c45f1f14b6df87 <
    0c9e6367639548307d3f578f6943ce72c9d39087
  - Linux 4.5
published: '2026-08-12'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T12:28:38.418Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-68445'
references:
  - url: 'https://git.kernel.org/stable/c/4c98260a967e8536c69437b8da8eea3188cd6db8'
  - url: 'https://git.kernel.org/stable/c/9f0ee411fc2d76333d6087c5862ffa907cf7a175'
  - url: 'https://git.kernel.org/stable/c/019e6ad247f7fd038d2e009789f6d9bfcccb1ae7'
  - url: 'https://git.kernel.org/stable/c/6deaa317201851c644c431b57682e54d06b35838'
  - url: 'https://git.kernel.org/stable/c/fe168ef1d232d734d9998fd74822e2e20930dfff'
  - url: 'https://git.kernel.org/stable/c/0c9e6367639548307d3f578f6943ce72c9d39087'
tags:
  - cve.org
epss: 0.00127
epssPercentile: 0.02367
ingestedAt: '2026-11-05T15:02:32.467Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/vc4: Prevent shader BO mappings from becoming writable

vc4_gem_object_mmap() rejects a writable mapping of a validated shader
BO, but leaves VM_MAYWRITE set.  Userspace can map the BO read-only and
then turn it writable with mprotect().

Validated shader BOs must stay read-only: the validator checks the
instructions once and the GPU trusts them afterwards.  A writable
mapping lets userspace rewrite the code after validation, bypassing the
validator.

Clear VM_MAYWRITE on the read-only path so the mapping cannot be
upgraded, as i915 already does for its read-only objects.

## Affected

- `Linux >= 463873d5701427f2964a0b4b72c45f1f14b6df87 < 4c98260a967e8536c69437b8da8eea3188cd6db8`
- `Linux >= 463873d5701427f2964a0b4b72c45f1f14b6df87 < 9f0ee411fc2d76333d6087c5862ffa907cf7a175`
- `Linux >= 463873d5701427f2964a0b4b72c45f1f14b6df87 < 019e6ad247f7fd038d2e009789f6d9bfcccb1ae7`
- `Linux >= 463873d5701427f2964a0b4b72c45f1f14b6df87 < 6deaa317201851c644c431b57682e54d06b35838`
- `Linux >= 463873d5701427f2964a0b4b72c45f1f14b6df87 < fe168ef1d232d734d9998fd74822e2e20930dfff`
- `Linux >= 463873d5701427f2964a0b4b72c45f1f14b6df87 < 0c9e6367639548307d3f578f6943ce72c9d39087`
- `Linux 4.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.