Executive brief
A vulnerability exists in the Linux kernel's VMware graphics driver (vmwgfx) that could allow a local user to crash the system or potentially execute unauthorized code. The issue occurs when the system incorrectly handles memory for graphics resources, leading to a 'use-after-free' condition. This could impact the stability and security of virtualized environments using VMware graphics acceleration.
Technical details
A use-after-free (UAF) vulnerability exists in drivers/gpu/drm/vmwgfx/vmwgfx_validation.c within the Linux kernel. The flaw is rooted in the validation duplicates hashtable, where nodes allocated from an arena allocator are expected to be cleared during vmw_validation_drop_ht. However, if a resource is destroyed prematurely, a node can escape this cleanup process while remaining in the hashtable, leading to a UAF when the arena is cleared at the end of vmw_execbuf_process. A local attacker with access to the graphics subsystem could exploit this to cause a kernel panic or achieve local privilege escalation. The issue has been patched by ensuring nodes are properly deleted from the RCU hashtable when resource referencing fails.
Affected products
- Linux Linux Kernel 4.20 to 6.11.x
Timeline
- 2025-09-26: disclosed: Initial patch submission by Ian Forbes
- 2025-10-29: patched: Patch committed to stable tree
- 2025-11-12: advisory: CVE published
References
- https://git.kernel.org/stable/c/1822e5287b7dfa59d0af966756ebf1dc652b60ee
- https://git.kernel.org/stable/c/4c918f9d1ccccc0e092f43dcb2d8266f54d7340b
- https://git.kernel.org/stable/c/655a2f29bfc21105c80bf8a7d7aafa6eca8b4496
- https://git.kernel.org/stable/c/65608e991c2d771c13404e5c7ae122ac3c3357a4
- https://git.kernel.org/stable/c/867bda5d95d36f10da398fd4409e21c7002b2332
- https://git.kernel.org/stable/c/9a8eaca539708ca532747f606d231f70e684e8ca
- https://git.kernel.org/stable/c/dfe1323ab3c8a4dd5625ebfdba44dc47df84512a