Linux kernel vmwgfx: dma_buf reference leaked on foreign prime import pins the exporter's memory indefinitely

Impact

ttm_prime_fd_to_handle() returns -ENOSYS when an imported fd's dma_buf->ops do not belong to the ttm_object_device, but it returns without dropping the reference dma_buf_get() took. Any unprivileged renderD client that passes a non-vmwgfx prime fd through DRM_VMW_GB_SURFACE_REF or its _EXT variant leaks one dma_buf reference per call and indefinitely pins the foreign exporter's GEM resources. A loop over that ioctl is a cheap local memory-exhaustion primitive inside a VMware guest: memory that is never reclaimed until reboot, which on a node you cannot drain cheaply is the expensive kind of failure. This is a distinct bug from the vmwgfx shader offset overflow in the same batch - different ioctl, different mechanism, different fix - and is listed separately for that reason.

Who can reach it

Local unprivileged user inside a VMware guest with access to a renderD node, calling the GB surface reference ioctls with a prime fd exported by some other driver. No authentication needed beyond opening the render node.

What to do

Update guest kernels to a build carrying the stable commits in the record, which route the error path through the existing dma_buf_put(); the record names no fixed version. Rollout is a guest kernel update and a reboot of each VM, and a reboot is also the only way to reclaim memory already leaked on a running guest.

References

Related entries

• Microsoft Hyper-V: vmswitch fails to validate guest OID requestsCVE-2021-28476 · Microsoft Hyper-VCritical
• Incus: instance snapshots bypass restricted.containers.lowlevel, giving command execution on the hostCVE-2026-48751 · Incus (instance snapshots ignore restricted.containers.lowlevel)Critical
• VMware ESXi (OpenSLP): Use-after-free in OpenSLP on port 427 - unauthenticated remote code execution on the hypervisorCVE-2020-3992 · VMware ESXi (OpenSLP)Critical
• Linux kernel mlx5_core kTLS RX offload: TLS RX resync list corruption: entries are moved by the resync handlerCVE-2021-47215 · Linux kernel mlx5_core kTLS RX offloadCritical
• Linux kernel (drivers/nvme/host): The NVMe/RDMA initiator destroys the queue pair before the connection manager ID, soCVE-2021-47378 · Linux kernel (drivers/nvme/host)Critical
• Linux kernel (net/tls): KTLS stored a negative errno into the socket error field where a positive value is expected. ACVE-2021-47496 · Linux kernel (net/tls)Critical