CVE-2026-80700

Received Received - Intake

Buffer Overflow in Linux Kernel vmwgfx Driver

Publication date: 2026-08-28

Last updated on: 2026-08-29

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate external BO copy bounds for both stride paths vmw_external_bo_copy() trusts caller-supplied offsets, strides, and heights and operates on imported dma-buf vmaps: - The equal-stride memcpy() bound was clamped after subtracting the offsets from dst_size and src_size; an offset larger than the BO size wraps the unsigned subtraction to a huge value and the resulting memcpy() runs off the end of the vmap. dst_stride * height is also a u32 multiplication that can overflow. - The non-equal-stride row-by-row path had no bound at all. The loop touches bytes through offset + (height - 1) * stride + width_in_bytes, with only a WARN_ON(dst_stride < width_in_bytes), and could likewise step past the end of either mapping. The offsets and strides are derived from STDU/SOU plane state, so a configured CRTC submitting a crafted atomic commit on an imported framebuffer can reach this path. Validate the exact row-copy endpoint against each BO's size up front using check_mul_overflow() and check_add_overflow(). Use the bulk memcpy() path only when width_in_bytes covers the whole stride; otherwise copy one row at a time so partial-row updates near the bottom of a framebuffer remain valid. Also reject zero strides and stride < width_in_bytes, both of which the row-by-row path cannot represent safely.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-29

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-80700

EUVD

EUVD-2026-67435

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a memory corruption vulnerability in the Linux kernel's drm/vmwgfx driver. It involves improper validation of external buffer object (BO) copy operations. The function vmw_external_bo_copy() does not properly check caller-supplied offsets, strides, and heights, which can lead to out-of-bounds memory access during memcpy operations. This happens because unsigned arithmetic wraps around when offsets exceed buffer sizes, and multiplication can overflow.

Detection Guidance

This vulnerability affects the Linux kernel's drm/vmwgfx driver and requires kernel-level access to detect. No network-specific detection commands are available. Check kernel logs for vmwgfx-related errors or crashes using: dmesg | grep vmwgfx. If you suspect exploitation, inspect framebuffer or CRTC configurations for malformed atomic commits.

Impact Analysis

An attacker with access to a system using the vulnerable Linux kernel could potentially cause memory corruption, leading to crashes, data corruption, or privilege escalation. The vulnerability can be triggered by a crafted atomic commit on an imported framebuffer, which may allow unauthorized memory access or system instability.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a memory corruption issue in the Linux kernel's DRM driver for VMware virtual GPUs. It could potentially lead to system instability or crashes but does not involve data exposure or unauthorized access that would typically impact regulatory compliance.

Mitigation Strategies

Update your Linux kernel to the latest patched version. If immediate patching is not possible, restrict access to DRM/KMS interfaces via kernel module blacklisting or sandboxing. Monitor for suspicious atomic commit operations on framebuffers.

Hi! I’m here to help you understand CVE-2026-80700. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70