Linux kernel drm/vmwgfx: boolean written to guest_memory_size drives out-of-bounds MOB dirty walks

CVE-2026-80702NVIDIA / GPU stackcurated

Impact

Two sites in vmwgfx_resource.c assigned boolean literals to res->guest_memory_size, an unsigned long allocation-size field, when the intended target was the adjacent guest_memory_dirty bitfield. The size then reads as 0 or 1, and later revalidation paths use it to compute the dirty page range and the buffer allocation size, producing zero-length walks or wrap-around ranges that read or write past the MOB bitmap. Dirty tracking is also silently lost, so the driver stops knowing which pages changed. As with the other vmwgfx defects this is reachable only inside VMware guests running the vmwgfx driver, from a process that can drive the DRM device - bare-metal GPU nodes and headless guests without vmwgfx loaded are unaffected.

Who can reach it

Local user with access to the vmwgfx DRM device inside a VMware virtual machine, exercising resource release and unbind paths. No remote or cross-VM vector is described in the record.

What to do

Update to a stable kernel carrying the linked commits and reboot the affected guests. Blacklisting vmwgfx on headless guests removes exposure in the meantime. No fixed release number is given beyond the stable commits.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-80702 https://git.kernel.org/stable/c/21bbe38faee4a195d33a93e3908e307807f7745d https://git.kernel.org/stable/c/3b2bb16a5b622867140d69925db411ac8ecb3b2b https://git.kernel.org/stable/c/9d6cbb76fe9cd760351f6b0b20f1bf788eab8fa6

Related entries

All NVIDIA / GPU stack entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.