Linux Kernel vc4 CVE-2026-68445

The drm/vc4 driver supports Broadcom VideoCore IV GPUs, used primarily in Raspberry Pi 1-3 and BCM2835/BCM2711 SoC-based embedded systems. The vc4 security model relies on a one-shot shader validator: GPU shader instructions in a buffer object (BO) are checked once before execution, after which the GPU implicitly trusts them. The vulnerability resides in vc4_gem_object_mmap(): while it correctly refuses an initial PROT_WRITE mmap() on a validated shader BO, it leaves the VMA flag VM_MAYWRITE set. The Linux kernel's mprotect() syscall uses VM_MAYWRITE to gate whether a mapping's protections can be upgraded; with VM_MAYWRITE still present, any subsequent mprotect(PROT_READ|PROT_WRITE) call on the read-only mapping succeeds. The fix clears VM_MAYWRITE on the read-only path, mirroring a pattern already established in the i915 driver for its read-only GEM objects. The root cause class is an incomplete enforcement of immutability post-validation - the initial guard is present but the VM permission flag is not properly locked down, creating a TOCTOU-adjacent permission escalation. CPE: cpe:2.3:a:linux:linux:*.