Linux kernel drm/vmwgfx: unvalidated offsets and strides overrun imported dma-buf maps in BO copy

CVE-2026-80700NVIDIA / GPU stackcurated

Impact

vmw_external_bo_copy() trusted caller-supplied offsets, strides and heights when copying into vmap'd imported dma-bufs. An offset larger than the buffer wrapped the unsigned size subtraction into a huge bound, dst_stride * height overflowed as a u32, and the unequal-stride row loop had no bound at all beyond a WARN_ON. The values come from STDU/SOU plane state, so a client holding the DRM device on a VMware guest with a configured CRTC can drive a memcpy off the end of a kernel mapping and corrupt kernel memory. This only matters where Linux runs as a VMware guest - vmwgfx is not present on bare-metal GPU nodes, and headless compute guests with no configured CRTC cannot reach the path at all, so for most fleets this is a hygiene patch rather than an urgent one.

Who can reach it

Local user able to open /dev/dri as DRM master on a VMware virtual machine that has a configured CRTC and an imported (dma-buf) framebuffer, submitting a crafted atomic commit. No remote path; no exposure on hosts where vmwgfx is not loaded.

What to do

Take a stable kernel containing the linked commits and reboot the affected guests. On headless VMware guests that never drive a display, blacklisting the vmwgfx module removes the exposure without a kernel update. The record gives no fixed version string beyond the stable commits.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-80700 https://git.kernel.org/stable/c/042ca38779554687fc32b66a28328e0d9a36c58f https://git.kernel.org/stable/c/5e4a2d15637a906cbd9bc98e0bf969f5f713e344 https://git.kernel.org/stable/c/e7b25a6011781ebfdbc458552cae6d4156732771

Related entries

All NVIDIA / GPU stack entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.