drm/vmwgfx: unvalidated pitch in cursor snooping allows out-of-bounds reads in a VMware guest

Impact

vmwgfx copied cursor data from a surface using a pitch supplied by userspace without validating it against the box dimensions, so a local user in a VMware guest can make the kernel read past the surface and leak adjacent kernel memory. The exposure is inside the guest kernel, not the ESXi host: it buys a local user kernel-memory disclosure, not cross-VM escape. This is relevant to operators running Linux VMs on VMware as part of the fleet's management or control-plane tier; bare-metal GPU nodes and VMs on other hypervisors do not load vmwgfx. The fix validates the pitch alongside the box dimensions before copying.

Who can reach it

Local, inside a VMware guest. An unprivileged local user needs access to the vmwgfx DRM device node to drive the cursor path; no authentication beyond a shell on the guest, and no reach from outside the VM.

What to do

Update the guest kernel to one carrying the validation fix (the git.kernel.org stable commits) and reboot the affected VMs. Nothing needs to change on the ESXi host, and no firmware work is involved, so this is ordinary guest kernel patching rather than a hypervisor maintenance window.

References

Related entries

• Linux net/smc: use-after-free on the CLC socket in smc_getname during link-group terminationCVE-2026-99032 · Linux kernel net/smc (smc_getname clcsock lifetime)High
• KVM SEV: unlocked set_page_dirty on get_user_pages_fast pages during guest memory populationCVE-2026-99177 · Linux kernel KVM SEV (sev_gmem_post_populate guest-memory population)High
• Linux kernel io_uring/waitid: repeated failed cancellations wrap the reference counter and double-complete a requestCVE-2026-99227 · Linux kernel io_uring waitid (31-bit cancel reference counter wrap)High
• Linux kernel io_uring/waitid: use-after-free when the wake handler clears ->head before owning the requestCVE-2026-99231 · Linux kernel io_uring waitid (use-after-free via ->head cleared before ownership)High
• Linux kernel sched_ext: DSQ consume and move paths operate on a task still being dispatchedCVE-2026-99269 · Linux kernel sched_ext (DSQ consume/move racing SCX_OPSS_DISPATCHING)High
• xrdp: out-of-bounds read parsing Confirm Active PDU crashes the server or leaks process memoryCVE-2026-33516 · xrdp (RDP capability exchange, Confirm Active PDU parsing)High