Linux Kernel CVE-2026-68474

The spufs (Synergistic Processing Unit filesystem) is a Linux kernel subsystem exclusive to IBM Cell Broadband Engine (Cell BE) processors, providing userspace programs access to SPU local store memory via mmap interfaces. The vulnerability is in spufs_mem_mmap_access() within the PowerPC architecture subtree. The function derives an offset as address - vma->vm_start and should clamp both this offset and the access length against LS_SIZE, the fixed local store buffer size returned by ctx->ops->get_ls(). Instead, it compares against vma->vm_end, which on 64-bit systems is always larger than the offset, so the bounds check never activates and len is never clamped to remaining local store space. Analogous guard logic already exists and functions correctly in spufs_mem_mmap_fault() and spufs_ps_fault(). No CWE is formally assigned by NVD, but the EUVD tag 'Buffer Overflow' and code mechanics map to CWE-125 (Out-of-Bounds Read) and CWE-787 (Out-of-Bounds Write). The vulnerability was introduced at commit a352894d07059649398c4769dc8b645e1a1dad88, traceable to Linux 2.6.27.