Linux kernel (drivers/gpu/drm/vmwgfx): When the copy of the fence reply back to userspace fails, the driver installs a

Impact

When the copy of the fence reply back to userspace fails, the driver installs a file descriptor it then tears down without releasing the fd table slot, leaving the tenant with a valid descriptor pointing at a freed file object. The tenant chooses when the copy fails, so this is a reliable, on-demand use-after-free on a core kernel object - the classic path to full kernel code execution from an unprivileged process.

Who can reach it

A tenant process holding /dev/dri/renderD* (or card*) on a vmwgfx device issues the execbuf or fence-event ioctl with a fence-reply pointer it has arranged to fault (unmapped or read-only page), then keeps using the leftover descriptor. Requires vmwgfx to be the DRM driver, i.e. workloads running inside VMware VMs. No privilege beyond the device node.

What to do

Boot a kernel carrying the vmwgfx fd_install ordering fix below. Interim: drop /dev/dri/* from untrusted containers running on VMware-backed nodes, or blacklist vmwgfx on nodes where the guest does not need 3D.

References

Related entries

• Linux kernel (drivers/gpu/drm/vmwgfx): User-resource lookup during command submission used a broken RCU fast path, soCVE-2022-48887 · Linux kernel (drivers/gpu/drm/vmwgfx)High
• Linux kernel (drivers/gpu/drm/vmwgfx): The dimensions of a DMA surface-copy box submitted in the command stream wereCVE-2022-50440 · Linux kernel (drivers/gpu/drm/vmwgfx)High
• Linux kernel (drivers/gpu/drm/vmwgfx): A guest process can get a node left in the vmwgfx validation hash table afterCVE-2025-40111 · Linux kernel (drivers/gpu/drm/vmwgfx)High
• Linux kernel (drivers/gpu/drm/vmwgfx): The vmwgfx command-buffer parser trusted a size field taken straight from theCVE-2025-40277 · Linux kernel (drivers/gpu/drm/vmwgfx)High
• Linux kernel (drivers/gpu/drm/vmwgfx): A tenant that asks for a fence event on its DRM fd and then reads the fd backCVE-2024-36960 · Linux kernel (drivers/gpu/drm/vmwgfx)High
• Linux kernel (drivers/gpu/drm/virtio): GEM handle values are guessable, and the driver dereferences the buffer objectCVE-2022-48899 · Linux kernel (drivers/gpu/drm/virtio)High