Linux kernel vmwgfx: undersized DRAW_PRIMITIVES header wraps the bound into an out-of-bounds read

Impact

vmw_cmd_draw() computed its declaration bound as (header->size - sizeof(cmd->body)) on a u32 taken straight from the user-supplied command stream. A header smaller than the body makes the unsigned subtraction wrap to nearly 4 GiB, so any numVertexDecls the caller supplies passes the check and the loop walks far past the end of the kernel command bounce buffer - an out-of-bounds read of kernel memory. In a VMware guest that is kernel memory disclosure, or a crash, driven by an unprivileged user with a render node. As with the sibling vmwgfx issue, the affected machines in a GPU estate are the ESXi-hosted management and utility VMs, not the accelerator nodes; guests that never load vmwgfx are unaffected.

Who can reach it

Unprivileged local user inside a VMware guest submitting a crafted command stream through an open /dev/dri render node. No remote path.

What to do

Update the guest kernel to a stable release with the header-size check and reboot the guest. Blacklisting vmwgfx on headless server VMs closes it without waiting for a kernel roll. Same window as CVE-2026-68446 - take both fixes together.

References