Linux kernel drm/vmwgfx: unvalidated offsets and strides overrun imported dma-buf maps in BO copy
Impact
vmw_external_bo_copy() trusted caller-supplied offsets, strides and heights when copying into vmap'd imported dma-bufs. An offset larger than the buffer wrapped the unsigned size subtraction into a huge bound, dst_stride * height overflowed as a u32, and the unequal-stride row loop had no bound at all beyond a WARN_ON. The values come from STDU/SOU plane state, so a client holding the DRM device on a VMware guest with a configured CRTC can drive a memcpy off the end of a kernel mapping and corrupt kernel memory. This only matters where Linux runs as a VMware guest - vmwgfx is not present on bare-metal GPU nodes, and headless compute guests with no configured CRTC cannot reach the path at all, so for most fleets this is a hygiene patch rather than an urgent one.
Who can reach it
Local user able to open /dev/dri as DRM master on a VMware virtual machine that has a configured CRTC and an imported (dma-buf) framebuffer, submitting a crafted atomic commit. No remote path; no exposure on hosts where vmwgfx is not loaded.
What to do
Take a stable kernel containing the linked commits and reboot the affected guests. On headless VMware guests that never drive a display, blacklisting the vmwgfx module removes the exposure without a kernel update. The record gives no fixed version string beyond the stable commits.
References
Related entries
- Linux kernel drm/vmwgfx: boolean written to guest_memory_size drives out-of-bounds MOB dirty walksCVE-2026-80702 · Linux kernel drm/vmwgfx (vmw_resource guest_memory_size clobbered by boolean assignment)High
- nouveau UVMM: failed sparse-unmap bind job frees a live VA region, leading to use-after-freeCVE-2026-89801 · Linux kernel nouveau UVMM (nouveau_uvmm_bind_job_submit OP_UNMAP_SPARSE error paths)High
- nouveau: channel-kill event stays subscribed after the fence context is freed, racing teardownCVE-2026-89803 · Linux kernel nouveau (nouveau_channel_del teardown ordering, channel-kill event)High
- drm_pagemap: use-after-put in the device-to-RAM migration error path, plus missing THP fallbackCVE-2026-89805 · Linux kernel drm_pagemap (drm_pagemap_migrate_populate_ram_pfn folio fallback)High
- amdkfd: uninitialized return on a hole in the migrated range drops VRAM pages just allocatedCVE-2026-89808 · Linux kernel amdkfd (svm_migrate_copy_to_vram, hole in the migration VM range)High
- amdkfd: device-to-RAM migration error path releases pages by DMA address, corrupting unrelated pagesCVE-2026-89810 · Linux kernel amdkfd (svm_migrate_copy_to_ram error path, DMA address used as PFN)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.