Linux kernel (drivers/gpu/drm/vmwgfx): A tenant that asks for a fence event on its DRM fd and then reads the fd back

Impact

A tenant that asks for a fence event on its DRM fd and then reads the fd back gets more bytes than the event actually contains, so adjacent kernel heap memory is copied into its buffer. That is a straight kernel-memory read primitive from an unprivileged process - enough to defeat KASLR and to harvest residual data left by other work on the box.

Who can reach it

An unprivileged process inside a VMware-hosted guest holding /dev/dri/card* or /dev/dri/renderD*: issue the vmwgfx fence-event ioctl, then read() the DRM fd. No capabilities needed. Only applies where vmwgfx is the GPU driver (ESXi/Workstation guests), so the exposure is tenant VMs, not bare-metal GPU nodes.

What to do

Boot a kernel carrying the fix (the record lists no fixed_in - take the stable backport from your distro tree, commits below). Interim: do not expose /dev/dri to untrusted processes inside vmwgfx guests.

References