CVE-2026-68262

This vulnerability in the drm/imagination GPU driver exposes a pointer arithmetic inversion that produces fundamentally different failure modes depending on the stride relationship between userspace and kernel objects. When the userspace stride exceeds the kernel object size, the kernel pointer advances too far, causing subsequent iterations to read from incorrect kernel addresses — an information disclosure where adjacent kernel memory leaks into userspace buffers. When userspace stride is smaller than the kernel object size, writes land at wrong offsets in userspace memory, enabling potential out-of-bounds corruption with attacker-controlled stride values. What makes this vulnerability analytically significant is that it evades the detection tools most organizations deploy. The pointers remain within valid mapped regions on both sides — no page faults, no access violations, no bounds violations that sanitizers catch. The semantic error lives in the logical layer between pointer arithmetic and memory operations: the code is correct within its mental model but advances the wrong pointer by the wrong amount. Static analysis that checks memory access bounds won't flag this because the bounds are technically correct; the offset within those bounds is wrong. The patch also corrects per-element padding clearing that was only happening once for the first element. When userspace stride exceeds kernel object size, padding regions between elements weren't being zeroed, leaking whatever residual data occupied those kernel padding regions. This indicates the original developer conflated a single-element clear pattern with multi-element iteration — a copy-paste or refactoring error that left the padding clearing logic incomplete. For defenders, the priority actions are: audit any copy loop in this driver (and adjacent GPU memory management code) where source and destination strides differ; verify that padding clearing logic executes per element, not once at loop entry; and treat the asymmetric failure profile as two distinct risk vectors requiring different monitoring. The disclosure path (stride mismatch leaking kernel memory) warrants sensitivity monitoring on userspace buffer contents. The corruption path (undersized stride causing wrong-offset writes) warrants integrity monitoring on the destination buffers. Given that GPU drivers handle ioctl paths reachable from non-privileged contexts and manage unusual memory topologies including firmware regions and other processes' GPU allocations, the attack surface for probing stride values is substantial despite the CVSS 7.1 score.

Reviewed through automated stages and approved by a human before publication.