The Linux kernel's powerpc/spufs subsystem contained a vulnerability in the spufs_mem_mmap_access() function where the local store offset was computed as address - vma->vm_start but bounds-checked against vma->vm_end instead of the local store size (LS_SIZE). On 64-bit systems, this caused the offset to always be below vma->vm_end, preventing the clamp from triggering and leaving the length unbounded against the LS_SIZE buffer returned by ctx->ops->get_ls(). This could lead to out-of-bounds memory access. The patch rejects offsets at or beyond LS_SIZE and clamps the length to the remaining space, mirroring protections already present in spufs_mem_mmap_fault() and spufs_ps_fault().

The vulnerability could allow out-of-bounds memory access within the local store buffer in the powerpc/spufs subsystem of the Linux kernel. This may lead to memory corruption or information disclosure depending on usage context. No known exploits are reported in the wild. The impact is limited to systems running the affected kernel code on the powerpc architecture.

A fix has been applied to the Linux kernel to properly validate offsets and clamp lengths in spufs_mem_mmap_access(). Users should update to a Linux kernel version that includes this fix. Since no patch links or specific fixed versions are provided in the data, check the official Linux kernel advisories or vendor updates for the exact fixed versions and apply them accordingly.