Database/Kernel, userspace & hypervisor
Linux kernel (drivers/gpu/drm/vmwgfx): User-resource lookup during command submission used a broken RCU fast path, so
Impact
User-resource lookup during command submission used a broken RCU fast path, so two threads submitting command buffers against shared resources corrupt the lookup state and crash the kernel. The same race is a resource-lifetime bug, not just a crash: a tenant can drive the lookup to operate on a resource that is being torn down.
Who can reach it
A tenant process holding /dev/dri/renderD* on a vmwgfx device submits command buffers from two threads referencing shared surfaces - the upstream reproducer is the stock IGT vmwgfx execbuf stress test, so weaponizing it requires no novel research. Conditional on vmwgfx being the DRM driver (VMware-backed nodes).
What to do
Boot a kernel carrying the vmwgfx resource-locking fix below. Interim: withhold /dev/dri/* from untrusted tenants on VMware-backed nodes, or blacklist vmwgfx where guests do not need 3D or shared surfaces.
References
Related entries
- Linux kernel (drivers/gpu/drm/vmwgfx): The dimensions of a DMA surface-copy box submitted in the command stream wereCVE-2022-50440 · Linux kernel (drivers/gpu/drm/vmwgfx)High
- Linux kernel (drivers/gpu/drm/vmwgfx): A guest process can get a node left in the vmwgfx validation hash table afterCVE-2025-40111 · Linux kernel (drivers/gpu/drm/vmwgfx)High
- Linux kernel (drivers/gpu/drm/vmwgfx): The vmwgfx command-buffer parser trusted a size field taken straight from theCVE-2025-40277 · Linux kernel (drivers/gpu/drm/vmwgfx)High
- Linux kernel (drivers/gpu/drm/vmwgfx): A tenant that asks for a fence event on its DRM fd and then reads the fd backCVE-2024-36960 · Linux kernel (drivers/gpu/drm/vmwgfx)High
- Linux kernel (drivers/gpu/drm/vmwgfx): When the copy of the fence reply back to userspace fails, the driver installs aCVE-2022-48771 · Linux kernel (drivers/gpu/drm/vmwgfx)High
- Linux kernel (drivers/gpu/drm/virtio): GEM handle values are guessable, and the driver dereferences the buffer objectCVE-2022-48899 · Linux kernel (drivers/gpu/drm/virtio)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.