Linux kernel (drivers/gpu/drm/vmwgfx): The dimensions of a DMA surface-copy box submitted in the command stream were

Impact

The dimensions of a DMA surface-copy box submitted in the command stream were never validated against the size of the destination image buffer, so a tenant-chosen copy box overflows the kernel-side memcpy. That is an out-of-bounds kernel heap write with attacker-controlled length and content - memory corruption, not just a crash.

Who can reach it

A tenant process holding /dev/dri/renderD* on a vmwgfx device submits a surface DMA command with an oversized copy box through the normal command-submission ioctl; the overflow happens while the kernel validates and snoops that command, before any display involvement. Conditional on vmwgfx being the DRM driver (VMware-backed nodes).

What to do

Boot a kernel carrying the vmwgfx copybox validation fix below. Interim: remove /dev/dri/* from untrusted containers on VMware-backed nodes, or blacklist vmwgfx where 3D is not required.

References

Related entries

• Linux kernel (drivers/gpu/drm/vmwgfx): A guest process can get a node left in the vmwgfx validation hash table afterCVE-2025-40111 · Linux kernel (drivers/gpu/drm/vmwgfx)High
• Linux kernel (drivers/gpu/drm/vmwgfx): The vmwgfx command-buffer parser trusted a size field taken straight from theCVE-2025-40277 · Linux kernel (drivers/gpu/drm/vmwgfx)High
• Linux kernel (drivers/gpu/drm/vmwgfx): A tenant that asks for a fence event on its DRM fd and then reads the fd backCVE-2024-36960 · Linux kernel (drivers/gpu/drm/vmwgfx)High
• Linux kernel (drivers/gpu/drm/vmwgfx): When the copy of the fence reply back to userspace fails, the driver installs aCVE-2022-48771 · Linux kernel (drivers/gpu/drm/vmwgfx)High
• Linux kernel (drivers/gpu/drm/vmwgfx): User-resource lookup during command submission used a broken RCU fast path, soCVE-2022-48887 · Linux kernel (drivers/gpu/drm/vmwgfx)High
• Linux kernel (drivers/gpu/drm/nouveau): Importing a dma-buf whose backing buffer object fails to initialize leaves theCVE-2022-50454 · Linux kernel (drivers/gpu/drm/nouveau)High