CVE-2026-80888
Received Received - Intake

DMA-BUF Reference Leak in Linux Kernel VMWGFX Driver

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: drop dma_buf reference on foreign-fd prime import ttm_prime_fd_to_handle() returns -ENOSYS when the imported fd's dma_buf->ops do not match the ttm_object_device's ops, but does so without releasing the reference acquired by dma_buf_get(). Any unprivileged renderD client passing a non-vmwgfx prime fd through the DRM_VMW_GB_SURFACE_REF{,_EXT} path leaks one dma_buf reference per call and indefinitely pins the foreign exporter's GEM resources. Funnel the error path through the existing dma_buf_put() so the reference is always dropped.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-05
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-80888
EUVD
EUVD-2026-71638

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the drm/vmwgfx driver where a reference to a dma_buf is not properly released when importing a foreign file descriptor. This leads to a leak of dma_buf references, causing the foreign exporter's GEM resources to remain pinned indefinitely.

Detection Guidance

This vulnerability is specific to the Linux kernel's drm/vmwgfx driver and involves improper handling of dma_buf references during prime import operations. Detection requires checking kernel logs for errors related to vmwgfx or dma_buf operations. Commands like dmesg | grep -i vmwgfx or journalctl -k | grep -i vmwgfx may help identify issues. Ensure your kernel version is updated to a patched release.

Impact Analysis

An unprivileged renderD client could exploit this flaw by passing a non-vmwgfx prime file descriptor through specific paths, causing resource exhaustion on the system. This may lead to denial-of-service conditions or instability due to pinned resources.

Mitigation Strategies

Immediately update your Linux kernel to the latest stable version that includes the fix for this vulnerability. If updating is not immediately possible, restrict access to renderD clients or disable the vmwgfx driver if not in use. Monitor kernel logs for unusual dma_buf reference leaks or vmwgfx-related errors.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80888. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart