Executive brief
The VMware graphics driver in the Linux kernel failed to properly validate the array_size parameter from userspace graphics API requests, potentially allowing a local attacker to trigger out-of-bounds access or memory corruption. This could lead to kernel crashes or privilege escalation on systems running affected kernels with VMware virtualized graphics enabled.
Technical details
The vulnerability exists in the drm/vmwgfx GPU driver's surface creation path (vmw_gb_surface_define_internal function). The array_size field, sourced from untrusted userspace ioctl requests, was not validated against shader model-specific limits (SVGA3D_SM4_MAX_SURFACE_ARRAYSIZE and SVGA3D_SM5_MAX_SURFACE_ARRAYSIZE). An attacker with local access and DRM device permissions can supply an oversized array_size value, bypassing bounds checks and potentially causing heap corruption or out-of-bounds memory access. The attack requires local access to /dev/dri/card* or similar DRM device nodes. The fix validates array_size against SM4/SM5 limits depending on available hardware capabilities.
Affected products
- Linux Linux kernel multiple versions (fixed in stable branches)
Timeline
- 2026-08-12: disclosed: CVE-2026-68446 published on NVD
- 2026-06-23: patched: Fix committed upstream by Ian Forbes
- 2026-08-19: patched: Fix merged into stable tree
- 2026-08-03: patched: Fix merged into earlier stable branches