Linux Kernel EUVD-2026-55363

The vulnerability resides in pvr_set_uobj_array() within the drivers/gpu/drm/imagination subsystem, which implements the DRM/KMS interface for Imagination Technologies PowerVR GPUs. The function is responsible for copying an array of in-kernel objects into a userspace buffer where the userspace element size (stride) may differ from the kernel object size - a common ABI-compatibility pattern. The slow-path loop incorrectly advanced the userspace pointer by obj_size and the kernel pointer by out->stride, reversing the intended direction. This means for out->stride > obj_size, the kernel pointer skips ahead faster than intended, reading from wrong kernel virtual addresses that may contain sensitive data from adjacent structures. For out->stride < obj_size, the userspace pointer lags, causing subsequent writes to overwrite already-written userspace memory at incorrect offsets. Additionally, per-element padding zeroing was only applied to the first element, leaving uninitialized bytes in subsequent elements. CPE data (cpe:2.3:a:linux:linux) confirms the affected product is the mainline Linux kernel. No specific CWE is formally assigned, but the root cause class is CWE-125 (Out-of-bounds Read) combined with CWE-119 (Improper Restriction of Operations within Bounds of a Memory Buffer).