CVE-2026-80887
Received Received - Intake

Integer Overflow in VMware Graphics Driver

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: use check_add_overflow for shader size+offset bound vmw_shader_define() validates the user-supplied shader window against its backing buffer with (u64)buffer->tbo.base.size < (u64)size + (u64)offset drm_vmw_shader_create_arg::offset is __u64 in the uapi; when it is near U64_MAX the unsigned addition wraps and the resulting tiny value passes the check. The unbounded offset is then stored in res->guest_memory_offset and forwarded to host SVGA shader-create commands. Use check_add_overflow() to detect the wrap and compare the resulting endpoint against the buffer size.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-05
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-80887
EUVD
EUVD-2026-71637

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper validation of shader window sizes and offsets in the vmwgfx driver. When a user supplies a shader offset near the maximum value of a 64-bit integer (U64_MAX), the addition of size and offset wraps around, creating a small value that bypasses a size check. This allows an unbounded offset to be stored and used in host commands, potentially leading to memory corruption or other security issues.

Detection Guidance

This vulnerability is specific to the Linux kernel's vmwgfx driver and requires kernel-level inspection. There are no direct network detection commands. To check for affected systems, verify if your kernel version includes the vulnerable code path by examining the vmwgfx driver module and its use of the unsafe addition pattern. Use commands like 'modinfo vmwgfx' to check the module version and 'dmesg | grep vmwgfx' for driver-related logs.

Impact Analysis

If exploited, this vulnerability could allow an attacker with local access to cause memory corruption, crash the system, or potentially escalate privileges. It may also enable denial-of-service attacks or unauthorized access to sensitive data, depending on the system configuration and kernel version.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it is a low-level kernel memory handling issue. Compliance impacts would depend on how the vulnerability is exploited in a specific system or application context.

Mitigation Strategies

Immediately update your Linux kernel to a patched version that includes the fix for this vulnerability. If updating is not immediately possible, consider disabling the vmwgfx driver if it is not required, as this vulnerability is specific to that driver. Monitor vendor advisories for kernel updates addressing this issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80887. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart