CVE-2026-68474

In the Linux kernel, the following vulnerability has been resolved:

powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access()

spufs_mem_mmap_access() computes the local store offset as

address - vma->vm_start, but bounds-checks it against vma->vm_end

instead of the local store size. On 64-bit, offset is always well

below vma->vm_end, so the clamp never fires and len stays unbounded

against the LS_SIZE buffer returned by ctx->ops->get_ls().

Reject offsets at or beyond LS_SIZE and clamp len to the remaining

space, mirroring the guard already used by spufs_mem_mmap_fault() and

spufs_ps_fault().