Linux kernel vmwgfx: integer overflow in the shader offset bound check lets an unbounded offset reach host SVGA commands

Impact

vmw_shader_define() validated the user-supplied shader window with an unsigned addition of size and offset; drm_vmw_shader_create_arg::offset is a __u64 in the uapi, so an offset near U64_MAX wraps and the check passes. The unbounded offset is then stored in res->guest_memory_offset and forwarded to the host in SVGA shader-create commands, which is a guest-to-host surface rather than a purely in-guest one. On virtualized infrastructure that means a local unprivileged user inside a VM feeds an out-of-range value across the guest/hypervisor boundary; the record does not characterize what the host does with it, so treat the ceiling as unproven and the exposure as real. Hosts do not run vmwgfx - only VMware guests do - so the affected population is your VM images, not the GPU nodes themselves.

Who can reach it

Local unprivileged user inside a VMware guest with access to a DRM render node on the vmwgfx driver. No authentication beyond an open of the device, which is normally world-accessible.

What to do

Update guest kernels to a build carrying the stable commits in the record, which use check_add_overflow() and compare the endpoint against the buffer size; the record names no fixed version. That means rebuilding or repatching VM images and rebooting each guest - a rolling workload restart, not a host maintenance window. Guests that have no use for vmwgfx render nodes can avoid exposing them.

References

Related entries

• Linux kernel vmwgfx: dma_buf reference leaked on foreign prime import pins the exporter's memory indefinitelyCVE-2026-80888 · Linux kernel vmwgfx (ttm_prime_fd_to_handle foreign-fd prime import)Unscored
• Linux kernel hugetlb: fork() corrupts migration and hwpoison swap entries by clearing uffd-wp at the wrong bitCVE-2026-80893 · Linux kernel mm/hugetlb (uffd-wp clearing in copy_hugetlb_page_range)Unscored
• Linux kernel iommufd: hwpt replace responds to faults on the wrong domain, stranding faults on the old hwptCVE-2026-80894 · Linux kernel iommufd (fault auto-response on hwpt replace)Unscored
• Linux kernel io_uring: eventfd signaled inline from a waitqueue wakeup handler can feed back into epollCVE-2026-80920 · Linux kernel io_uring (eventfd signaling on DEFER_TASKRUN rings)Unscored
• Linux crypto iaa: DMA buffer not unmapped before software fallback corrupts decompressed dataCVE-2026-80945 · Linux kernel crypto/iaa (Intel In-Memory Analytics Accelerator decompress path)Unscored
• Linux fuse io-uring: request headers copied from a non-whitelisted slab object panics hardened usercopyCVE-2026-80946 · Linux kernel FUSE io-uring transport (fuse_request header usercopy)Unscored