Linux kernel (drivers/gpu/drm/vmwgfx): A guest process can get a node left in the vmwgfx validation hash table after

Impact

A guest process can get a node left in the vmwgfx validation hash table after its backing resource has already been destroyed, so the next command submission dereferences freed memory. Use-after-free inside the execbuf validation path is directly weaponisable for guest kernel privilege escalation, and it lives in the code that every 3D command submission goes through.

Who can reach it

Reachable by any process inside a VMware guest that holds /dev/dri/renderD* or /dev/dri/card* - the bug is in vmw_execbuf_process's validation bookkeeping, so it is on the ordinary command-submission path. Relevant wherever tenant workloads run as VMware guests with the paravirtual vmwgfx GPU exposed; not applicable to bare-metal GPU nodes.

What to do

Update guest kernels to a build carrying the fix commits below. Interim: drop /dev/dri device nodes from untrusted guest containers, or configure the VM without the vmwgfx 3D device so the render node is not present.

References