Linux kernel vmwgfx: unbounded MOB cursor dimensions lead to NULL-pointer oops in the guest
Impact
vmw_cursor_plane_atomic_check() only bounds cursor width and height on the legacy update path. On the SVGA_CAP2_CURSOR_MOB path - the default on modern VMware hosts - an oversized cursor makes vmw_cursor_mob_get() return -EINVAL and leave the backing MOB NULL, and that error is then discarded in prepare_fb, so the update path dereferences NULL and oopses the guest kernel. The result is a crash of the virtual machine, not of the hypervisor: this does not cross the VM boundary and gives no code execution or data disclosure in the record as written. For an operator the cost is an unplanned guest reboot of any VMware-hosted Linux VM whose console device is reachable by a local user, which matters most for management and control-plane VMs rather than for bare-metal GPU nodes.
Who can reach it
A local user in the VMware guest who can hold DRM master on the virtual SVGA device (typically console or seat access, or any user able to open the card node when no master is held) issues DRM_IOCTL_MODE_CURSOR2 with a width or height above the device maximum. Authentication as a local user is required; there is no remote or cross-VM path.
What to do
Pick up the fix from the stable kernel commits in the guest kernel and reboot the VM - this is a kernel-side change, so no hypervisor or firmware work is involved. On headless VMs where nothing needs the virtual display, blacklisting or not loading vmwgfx removes the exposure entirely without a kernel update. The record lists stable commits but no fixed release numbers; confirm the version from your distribution's advisory.
References
Related entries
- Linux kernel amdkfd: any /dev/kfd holder can disable another process's GPU debug sessionCVE-2026-80703 · Linux kernel amdkfd (KFD_IOC_DBG_TRAP_DISABLE ioctl)Unscored
- GPU / accelerator firmware (VBIOS, GSP, NVSwitch): GPU-resident firmware sits below the host OS and is not coveredNCVD-0000-012-gpu-accelerator-firmware-vbios-g · GPU / accelerator firmware (VBIOS, GSP, NVSwitch)Unscored
- NVIDIA Multi-Instance GPU (MIG) partitioning: MIG gives each instance its own SM slice, L2 slice, memory slice andNCVD-2020-001-nvidia-multi-instance-gpu-mig-pa · NVIDIA Multi-Instance GPU (MIG) partitioningUnscored
- NVIDIA Multi-Instance GPU (MIG) partitioning: MIG gives each instance its own SM slice, L2 slice, memory slice andNCVD-2020-003-nvidia-multi-instance-gpu-mig-pa · NVIDIA Multi-Instance GPU (MIG) partitioningUnscored
- Integrated GPU graphics data compression (Intel, AMD, Apple, Arm, Qualcomm, NVIDIA): GPUs apply data-dependent losslessNCVD-2023-003-integrated-gpu-graphics-data-com · Integrated GPU graphics data compression (Intel, AMD, Apple, Arm, Qualcomm, NVIDIA)Unscored
- NVIDIA Confidential Computing (H100/H200/B100/B200/GB200) - CC-DevTools operating mode: NVIDIA GPU confidentialNCVD-2023-004-nvidia-confidential-computing-h1 · NVIDIA Confidential Computing (H100/H200/B100/B200/GB200) - CC-DevTools operating modeUnscored
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.