Executive brief
The Linux kernel's VMware graphics driver (vmwgfx) contains a memory safety flaw in how it copies data to and from external graphics buffers. An attacker with the ability to submit a malicious graphics configuration can trigger an out-of-bounds memory read or write, potentially leading to system crashes, information disclosure, or privilege escalation.
Technical details
The vulnerability exists in the vmw_external_bo_copy() function in drivers/gpu/drm/vmwgfx/vmwgfx_blit.c. The function failed to properly validate caller-supplied offsets, strides, and heights when copying data to imported DMA-buf virtual mappings. In the equal-stride code path, unsigned integer underflow could occur when subtracting offsets from buffer sizes, creating huge values that bypass bounds checks. Additionally, the u32 multiplication of dst_stride * height could overflow. In the non-equal-stride row-by-row path, there were no bounds checks at all. An attacker with local access could craft a malicious atomic commit on an imported framebuffer bound to a configured CRTC to trigger memory access beyond buffer boundaries. The fix validates row-copy endpoints using overflow checking functions before the copy operations and rejects invalid stride values.
Affected products
- Linux Linux kernel Affected versions include Linux 5.0 through 6.9 and later kernels prior to the fix (commit 706c93c5813caabbb0d0a576c017d15aeec2c113)
Timeline
- 2026-08-28: disclosed: Published in NVD and Linux stable tree
- 2026-05-05: patched: Upstream commit 706c93c5813caabbb0d0a576c017d15aeec2c113 authored by Zack Rusin