CVE-2026-80700drm/vmwgfx: validate external BO copy bounds for both stride paths
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate external BO copy bounds for both stride paths vmw_external_bo_copy() trusts caller-supplied offsets, strides, and heights and operates on imported dma-buf vmaps: - The equal-stride memcpy() bound was clamped after subtracting the offsets from dst_size and src_size; an offset larger than the BO size wraps the unsigned subtraction to a huge value and the resulting memcpy() runs off the end of the vmap. dst_stride * height is also a u32 multiplication that can overflow. - The non-equal-stride row-by-row path had no bound at all. The loop touches bytes through offset + (height - 1) * stride + width_in_bytes, with only a WARN_ON(dst_stride < width_in_bytes), and could likewise step past the end of either mapping. The offsets and strides are derived from STDU/SOU plane state, so a configured CRTC submitting a crafted atomic commit on an imported framebuffer can reach this path. Validate the exact row-copy endpoint against each BO's size up front using check_mul_overflow() and check_add_overflow(). Use the bulk memcpy() path only when width_in_bytes covers the whole stride; otherwise copy one row at a time so partial-row updates near the bottom of a framebuffer remain valid. Also reject zero strides and stride < width_in_bytes, both of which the row-by-row path cannot represent safely.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 9a9716bbbf3dd6b6cbefba3abcc89af8b72631f4 builds before 4e0f669e2951b742239c6fe847fcc406fe78748d; from 50f1199250912568606b3778dc56646c10cb7b04 before e7b25a6011781ebfdbc458552cae6d4156732771; 50f1199250912568606b3778dc56646c10cb7b04 builds before 042ca38779554687fc32b66a28328e0d9a36c58f; 50f1199250912568606b3778dc56646c10cb7b04 builds before 5e4a2d15637a906cbd9bc98e0bf969f5f713e344; from 50f1199250912568606b3778dc56646c10cb7b04 before 706c93c5813caabbb0d0a576c017d15aeec2c113; 5c12391ee1ab59cb2f3be3f1f5e6d0fc0c2dc854; from 6.6.49 before 6.6.151; from 6.10.8 before 6.11 | CNA record |
References
- https://git.kernel.org/stable/c/4e0f669e2951b742239c6fe847fcc406fe78748d
- https://git.kernel.org/stable/c/e7b25a6011781ebfdbc458552cae6d4156732771
- https://git.kernel.org/stable/c/042ca38779554687fc32b66a28328e0d9a36c58f
- https://git.kernel.org/stable/c/5e4a2d15637a906cbd9bc98e0bf969f5f713e344
- https://git.kernel.org/stable/c/706c93c5813caabbb0d0a576c017d15aeec2c113
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.