Linux kernel vmwgfx: failed handle lookup returns success, leading to uninitialized and out-of-bounds access

CVSS 7.8CVE-2026-23317Kernel, userspace & hypervisorcurated

Impact

The vmw_translate_ptr helpers were converted to return an error code with the resource pointer as an out parameter, but the failure path still returned PTR_ERR of an uninitialized pointer. A lookup that should fail can therefore report success, and the caller proceeds to use an uninitialized pointer, giving uninitialized and out-of-bounds kernel memory access on the command-submission path. On a fleet where tenant workloads run as VMware guests with the paravirtual vmwgfx device exposed, this is a guest-kernel privilege escalation primitive reachable from an ordinary unprivileged process. It does not apply to bare-metal GPU nodes, which do not load vmwgfx.

Who can reach it

A local, unprivileged process inside a VMware guest that can open /dev/dri/renderD* or /dev/dri/card* and submit commands. No special capability needed beyond access to the render node; not reachable remotely and not present on hosts without the vmwgfx device.

What to do

Update guest kernels to a build carrying the stable fix commits below and reboot the guest; there is no runtime mitigation inside the driver. Until then, remove /dev/dri device nodes from untrusted guest containers, or configure the VM without the vmwgfx 3D device so no render node exists. Bare-metal nodes need no action.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-23317 https://git.kernel.org/stable/c/149f028772fa2879d9316b924ce948a6a0877e45 https://git.kernel.org/stable/c/36cb28b6d303a81e6ed4536017090e85e0143e42

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.