CVE-2026-68473

HighCVSS 7.8/10Last modified Aug 17, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

powerpc/uaccess: correct check for CONFIG_PPC_E500 in mask_user_address()

mask_user_address() incorrectly checks for CONFIG_E500 instead of CONFIG_PPC_E500, causing mask_user_address_isel() to not be used on E500 hardware. Fix the check to use the correct name.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Linux	Linux	>= 861574d51bbd7a06dbf07f658a9a8def012c2f74, < d5c234774a82f27b594f70c15fc45ce3648e4295; >= 861574d51bbd7a06dbf07f658a9a8def012c2f74, < d610d3ab18197d87618da11ec5fe8b3cebf32208
Linux	Linux	7.0

References

Timeline

Published: Aug 15, 2026
Last modified: Aug 17, 2026
NVD status: Received

Related CVEs from 2026

CVE-2026-684747.8In the Linux kernel, the following vulnerability has been resolved: powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access() spu CVE-2026-68475In the Linux kernel, the following vulnerability has been resolved: reset: sunxi: fix memory region leak on ioremap failure In sunxi_reset CVE-2026-684769.8In the Linux kernel, the following vulnerability has been resolved: ipvs: reload ip header after head reallocation __ip_vs_get_out_rt() ca CVE-2026-684779.8In the Linux kernel, the following vulnerability has been resolved: ipvs: fix more places with wrong ipv6 transport offsets Sashiko report CVE-2026-68478In the Linux kernel, the following vulnerability has been resolved: memstick: ms_block: reject a card that reports too many blocks msb_ftl CVE-2026-684797.8In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: validate firmware patch bounds rtlbt_parse_firmware(CVE-2026-68488.1A flaw was found in Red Hat Quay. When Red Hat Quay requests password re-verification for sensitive operations, such as token generation or CVE-2026-68480In the Linux kernel, the following vulnerability has been resolved: x86/bugs: Make Safe-RET robust against interrupt injection An attacker CVE-2026-684817.5In Apache CXF's DefaultEncryptingOAuthDataProvider, revoked access tokens still decrypt successfully, and TokenIntrospectionService reports CVE-2026-684825.3Missing Authorization vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. An unauthenticated or unauthorize CVE-2026-684849.0Cash Collect contains an improper authorization vulnerability in the Sage AR Automation API. Administrative functions do not properly verify CVE-2026-684854.3An authorization bypass in website-index.php in Revive Adserver 6.0.8 and earlier allows an authenticated manager restricted to one agency t