CVE-2026-80887drm/vmwgfx: use check_add_overflow for shader size+offset bound
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: use check_add_overflow for shader size+offset bound vmw_shader_define() validates the user-supplied shader window against its backing buffer with (u64)buffer->tbo.base.size < (u64)size + (u64)offset drm_vmw_shader_create_arg::offset is __u64 in the uapi; when it is near U64_MAX the unsigned addition wraps and the resulting tiny value passes the check. The unbounded offset is then stored in res->guest_memory_offset and forwarded to host SVGA shader-create commands. Use check_add_overflow() to detect the wrap and compare the resulting endpoint against the buffer size.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 4, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 668b206601c5f5063e03b76784a0d3024fa2b249 builds before 1bbe7751f5ebac383405ef29a66622d65bd505d3; from 668b206601c5f5063e03b76784a0d3024fa2b249 before d3f44438aa805270aaead3b6840ccaea0f4c11f9; from 668b206601c5f5063e03b76784a0d3024fa2b249 before cfd163169af3be56eaef113c680ea251f0d09189; 668b206601c5f5063e03b76784a0d3024fa2b249 builds before 5c725901908eb1e52a16fc0e2373cb761df42d21; 668b206601c5f5063e03b76784a0d3024fa2b249 builds before 54d56d5b42d2e4c72ba6e365e9774da90698aa22 | CNA record |
References
- https://git.kernel.org/stable/c/1bbe7751f5ebac383405ef29a66622d65bd505d3
- https://git.kernel.org/stable/c/d3f44438aa805270aaead3b6840ccaea0f4c11f9
- https://git.kernel.org/stable/c/cfd163169af3be56eaef113c680ea251f0d09189
- https://git.kernel.org/stable/c/5c725901908eb1e52a16fc0e2373cb761df42d21
- https://git.kernel.org/stable/c/54d56d5b42d2e4c72ba6e365e9774da90698aa22
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.