GPU VulnDB

Database/NVIDIA / GPU stack

Linux kernel vmwgfx: unbounded MOB cursor dimensions lead to NULL-pointer oops in the guest

UnscoredCVE-2026-80701NVIDIA / GPU stackcurated

Impact

vmw_cursor_plane_atomic_check() only bounds cursor width and height on the legacy update path. On the SVGA_CAP2_CURSOR_MOB path - the default on modern VMware hosts - an oversized cursor makes vmw_cursor_mob_get() return -EINVAL and leave the backing MOB NULL, and that error is then discarded in prepare_fb, so the update path dereferences NULL and oopses the guest kernel. The result is a crash of the virtual machine, not of the hypervisor: this does not cross the VM boundary and gives no code execution or data disclosure in the record as written. For an operator the cost is an unplanned guest reboot of any VMware-hosted Linux VM whose console device is reachable by a local user, which matters most for management and control-plane VMs rather than for bare-metal GPU nodes.

Who can reach it

A local user in the VMware guest who can hold DRM master on the virtual SVGA device (typically console or seat access, or any user able to open the card node when no master is held) issues DRM_IOCTL_MODE_CURSOR2 with a width or height above the device maximum. Authentication as a local user is required; there is no remote or cross-VM path.

What to do

Pick up the fix from the stable kernel commits in the guest kernel and reboot the VM - this is a kernel-side change, so no hypervisor or firmware work is involved. On headless VMs where nothing needs the virtual display, blacklisting or not loading vmwgfx removes the exposure entirely without a kernel update. The record lists stable commits but no fixed release numbers; confirm the version from your distribution's advisory.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-80701https://git.kernel.org/stable/c/1eb4f796695be39e0b5c4383350033ced9ade703https://git.kernel.org/stable/c/9109b7935b9c058b75348610ef8437c52f9020e3https://git.kernel.org/stable/c/d5ed8749168ad13c0dbaa8300f68d854b6076966

Related entries

All NVIDIA / GPU stack entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.