CVE-2026-68262

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/imagination: Fix user array stride in pvr_set_uobj_array()<br /> <br /> pvr_set_uobj_array() copies an array of kernel objects to a userspace<br /> array whose element size is described by out-&gt;stride. When out-&gt;stride<br /> is different from the kernel object size, the slow path advances the<br /> userspace pointer by the kernel object size and the kernel pointer by the<br /> userspace stride.<br /> <br /> This reverses the intended layout. For larger userspace strides, later<br /> copies read from the wrong kernel addresses. For smaller userspace<br /> strides, later copies are written at the wrong userspace offsets. The<br /> padding clear is also done only for the first element instead of the<br /> padding area for each element.<br /> <br /> Advance the userspace pointer by out-&gt;stride and the kernel pointer by<br /> obj_size, and clear per-element padding while the current userspace<br /> pointer is still available.