Linux kernel drm/vmwgfx: boolean written to guest_memory_size drives out-of-bounds MOB dirty walks
Impact
Two sites in vmwgfx_resource.c assigned boolean literals to res->guest_memory_size, an unsigned long allocation-size field, when the intended target was the adjacent guest_memory_dirty bitfield. The size then reads as 0 or 1, and later revalidation paths use it to compute the dirty page range and the buffer allocation size, producing zero-length walks or wrap-around ranges that read or write past the MOB bitmap. Dirty tracking is also silently lost, so the driver stops knowing which pages changed. As with the other vmwgfx defects this is reachable only inside VMware guests running the vmwgfx driver, from a process that can drive the DRM device - bare-metal GPU nodes and headless guests without vmwgfx loaded are unaffected.
Who can reach it
Local user with access to the vmwgfx DRM device inside a VMware virtual machine, exercising resource release and unbind paths. No remote or cross-VM vector is described in the record.
What to do
Update to a stable kernel carrying the linked commits and reboot the affected guests. Blacklisting vmwgfx on headless guests removes exposure in the meantime. No fixed release number is given beyond the stable commits.
References
Related entries
- nouveau UVMM: failed sparse-unmap bind job frees a live VA region, leading to use-after-freeCVE-2026-89801 · Linux kernel nouveau UVMM (nouveau_uvmm_bind_job_submit OP_UNMAP_SPARSE error paths)High
- nouveau: channel-kill event stays subscribed after the fence context is freed, racing teardownCVE-2026-89803 · Linux kernel nouveau (nouveau_channel_del teardown ordering, channel-kill event)High
- drm_pagemap: use-after-put in the device-to-RAM migration error path, plus missing THP fallbackCVE-2026-89805 · Linux kernel drm_pagemap (drm_pagemap_migrate_populate_ram_pfn folio fallback)High
- amdkfd: uninitialized return on a hole in the migrated range drops VRAM pages just allocatedCVE-2026-89808 · Linux kernel amdkfd (svm_migrate_copy_to_vram, hole in the migration VM range)High
- amdkfd: device-to-RAM migration error path releases pages by DMA address, corrupting unrelated pagesCVE-2026-89810 · Linux kernel amdkfd (svm_migrate_copy_to_ram error path, DMA address used as PFN)High
- amdgpu: rings outside a partition index the isolation array out of bounds on SDMA submitCVE-2026-89814 · Linux kernel amdgpu (adev->isolation[] indexed with AMDGPU_XCP_NO_PARTITION)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.