Linux kernel vmwgfx: surface array_size taken from userspace without a shader-model bound
Impact
vmw_surface_metadata::array_size arrives from userspace and was not validated against the limits the available Shader Model imposes. vmwgfx is the guest DRM driver for Linux VMs on VMware ESXi, which in most GPU estates means the management, build and utility VMs sitting alongside the accelerator hosts rather than the GPU nodes themselves. NVD rates the result 7.8 local with full C/I/A - guest-kernel compromise reachable by an unprivileged user inside the VM, so a foothold in a low-value utility VM becomes root in that VM. Guests with no virtual SVGA device, or where vmwgfx never loads, are not exposed.
Who can reach it
Unprivileged local user inside a VMware guest holding an open /dev/dri render node. No remote path, and nothing to exploit if the vmwgfx module is not loaded.
What to do
Update the guest kernel to a stable release carrying the validation fix and reboot the guest - this is guest-side work, not an ESXi host patch. For headless server VMs that have no need for a virtual display, blacklisting vmwgfx removes the attack surface without a kernel update.
References
Related entries
- NVIDIA/Mellanox ConnectX driver (mlx5_ib user access region index release): The driver released the software-side UARCVE-2026-74296 · NVIDIA/Mellanox ConnectX driver (mlx5_ib user access region index release)High
- Linux kernel amdgpu RAS / GPU reset and recovery path (drm/amdgpu): An out-of-bounds access in the amdgpu RAS / GPUCVE-2026-74357 · Linux kernel amdgpu RAS / GPU reset and recovery path (drm/amdgpu)High
- Linux kernel vmwgfx: undersized DRAW_PRIMITIVES header wraps the bound into an out-of-bounds readCVE-2026-74444 · Linux kernel drm/vmwgfx (vmw_cmd_draw DRAW_PRIMITIVES header size)High
- Linux kernel amdgpu display core (DC/DM) (drm/amd/display): An out-of-bounds access in the amdgpu display core (DC/DM)CVE-2026-74449 · Linux kernel amdgpu display core (DC/DM) (drm/amd/display)High
- Linux kernel amdgpu power management (SMU/powerplay) (drm/amd/pm): A use-after-free in the amdgpu power managementCVE-2026-74450 · Linux kernel amdgpu power management (SMU/powerplay) (drm/amd/pm)High
- Linux kernel drm_gem_shmem: PMD huge-page fault can map past the VMA end and trip VM_BUG_ONCVE-2026-80582 · Linux kernel DRM GEM shmem helper (drm_gem_shmem ->huge_fault PMD path)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.