Linux kernel vmwgfx: dma_buf reference leaked on foreign prime import pins the exporter's memory indefinitely

Impact

ttm_prime_fd_to_handle() returns -ENOSYS when an imported fd's dma_buf->ops do not belong to the ttm_object_device, but it returns without dropping the reference dma_buf_get() took. Any unprivileged renderD client that passes a non-vmwgfx prime fd through DRM_VMW_GB_SURFACE_REF or its _EXT variant leaks one dma_buf reference per call and indefinitely pins the foreign exporter's GEM resources. A loop over that ioctl is a cheap local memory-exhaustion primitive inside a VMware guest: memory that is never reclaimed until reboot, which on a node you cannot drain cheaply is the expensive kind of failure. This is a distinct bug from the vmwgfx shader offset overflow in the same batch - different ioctl, different mechanism, different fix - and is listed separately for that reason.

Who can reach it

Local unprivileged user inside a VMware guest with access to a renderD node, calling the GB surface reference ioctls with a prime fd exported by some other driver. No authentication needed beyond opening the render node.

What to do

Update guest kernels to a build carrying the stable commits in the record, which route the error path through the existing dma_buf_put(); the record names no fixed version. Rollout is a guest kernel update and a reboot of each VM, and a reboot is also the only way to reclaim memory already leaked on a running guest.

References

Related entries

• Linux kernel hugetlb: fork() corrupts migration and hwpoison swap entries by clearing uffd-wp at the wrong bitCVE-2026-80893 · Linux kernel mm/hugetlb (uffd-wp clearing in copy_hugetlb_page_range)Unscored
• Linux kernel iommufd: hwpt replace responds to faults on the wrong domain, stranding faults on the old hwptCVE-2026-80894 · Linux kernel iommufd (fault auto-response on hwpt replace)Unscored
• Linux kernel io_uring: eventfd signaled inline from a waitqueue wakeup handler can feed back into epollCVE-2026-80920 · Linux kernel io_uring (eventfd signaling on DEFER_TASKRUN rings)Unscored
• Linux crypto iaa: DMA buffer not unmapped before software fallback corrupts decompressed dataCVE-2026-80945 · Linux kernel crypto/iaa (Intel In-Memory Analytics Accelerator decompress path)Unscored
• Linux fuse io-uring: request headers copied from a non-whitelisted slab object panics hardened usercopyCVE-2026-80946 · Linux kernel FUSE io-uring transport (fuse_request header usercopy)Unscored
• Linux net/smc: connection freed before tasklet drain leaves a use-after-free on the SMC-D receive pathCVE-2026-80979 · Linux kernel net/smc (SMC-D connection teardown vs. rx tasklet)Unscored