CVE-2026-80888drm/vmwgfx: drop dma_buf reference on foreign-fd prime import
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: drop dma_buf reference on foreign-fd prime import ttm_prime_fd_to_handle() returns -ENOSYS when the imported fd's dma_buf->ops do not match the ttm_object_device's ops, but does so without releasing the reference acquired by dma_buf_get(). Any unprivileged renderD client passing a non-vmwgfx prime fd through the DRM_VMW_GB_SURFACE_REF{,_EXT} path leaks one dma_buf reference per call and indefinitely pins the foreign exporter's GEM resources. Funnel the error path through the existing dma_buf_put() so the reference is always dropped.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 14, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 65981f7681abdf92b25942222b629b9c512d0705 before 1715901e7052cf90fbf04c8303e563a47e021278; from 65981f7681abdf92b25942222b629b9c512d0705 before c4fd91ee7228f56fbb4cf528757dc17ffefeb0ee; 65981f7681abdf92b25942222b629b9c512d0705 builds before 619c3cfa88e09603a13d918f754808db2dda7057; from 65981f7681abdf92b25942222b629b9c512d0705 before c1c22fca0a0896a452a7cb92422d67babd65b4be; from 65981f7681abdf92b25942222b629b9c512d0705 before a1e972fa94c3a8069e022c67b9d97c7aa7b05293; from 65981f7681abdf92b25942222b629b9c512d0705 before a8434b145b1e467940334c58c00af241e9494c5f; 65981f7681abdf92b25942222b629b9c512d0705 builds before 4df39eb99bb47d1f24d1952c23b21b10988356bf; from 65981f7681abdf92b25942222b629b9c512d0705 before f739416dc555fa205a785e5135d73fa39b26f35d | CNA record |
References
- https://git.kernel.org/stable/c/1715901e7052cf90fbf04c8303e563a47e021278
- https://git.kernel.org/stable/c/c4fd91ee7228f56fbb4cf528757dc17ffefeb0ee
- https://git.kernel.org/stable/c/619c3cfa88e09603a13d918f754808db2dda7057
- https://git.kernel.org/stable/c/c1c22fca0a0896a452a7cb92422d67babd65b4be
- https://git.kernel.org/stable/c/a1e972fa94c3a8069e022c67b9d97c7aa7b05293
- https://git.kernel.org/stable/c/a8434b145b1e467940334c58c00af241e9494c5f
- https://git.kernel.org/stable/c/4df39eb99bb47d1f24d1952c23b21b10988356bf
- https://git.kernel.org/stable/c/f739416dc555fa205a785e5135d73fa39b26f35d
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.