Linux kernel (drivers/gpu/drm/vmwgfx): The vmwgfx command-buffer parser trusted a size field taken straight from the

Impact

The vmwgfx command-buffer parser trusted a size field taken straight from the guest's command stream and used it in buffer offset arithmetic, so an oversized value overflows the calculation and walks the kernel off the end of the command buffer. That is an attacker-chosen out-of-bounds access inside the guest kernel, reachable from any process that can submit GPU commands.

Who can reach it

A container or process inside a VMware guest holding /dev/dri/renderD* submits an execbuf whose SVGA command header declares a size beyond SVGA_CMD_MAX_DATASIZE. Pure userspace-to-kernel input validation failure, no privileges beyond the render node. Applies only where tenants run as VMware guests with the vmwgfx device present.

What to do

Update guest kernels to a build with the fix commits below. Interim: remove /dev/dri from untrusted guest containers, or remove the virtual 3D device from tenant VMs entirely.

References

Related entries

• Linux kernel (drivers/gpu/drm/vmwgfx): A tenant that asks for a fence event on its DRM fd and then reads the fd backCVE-2024-36960 · Linux kernel (drivers/gpu/drm/vmwgfx)High
• Linux kernel (drivers/gpu/drm/vmwgfx): When the copy of the fence reply back to userspace fails, the driver installs aCVE-2022-48771 · Linux kernel (drivers/gpu/drm/vmwgfx)High
• Linux kernel (drivers/gpu/drm/vmwgfx): User-resource lookup during command submission used a broken RCU fast path, soCVE-2022-48887 · Linux kernel (drivers/gpu/drm/vmwgfx)High
• Linux kernel (drivers/gpu/drm/vmwgfx): The dimensions of a DMA surface-copy box submitted in the command stream wereCVE-2022-50440 · Linux kernel (drivers/gpu/drm/vmwgfx)High
• Linux kernel (drivers/gpu/drm/vmwgfx): A guest process can get a node left in the vmwgfx validation hash table afterCVE-2025-40111 · Linux kernel (drivers/gpu/drm/vmwgfx)High
• VMware Aria Operations / VMware Tools: Local privilege escalation to root inside a managed VM via SDMP service discoveryCVE-2025-41244 · VMware Aria Operations / VMware ToolsHigh