Executive brief
The Linux kernel's VMware graphics driver did not properly validate cursor dimensions in certain code paths, allowing a privileged user (DRM master) to specify oversized cursors that could trigger a kernel crash. This affects availability of systems running the vulnerable kernel on VMware virtual machines.
Technical details
The vulnerability exists in vmw_cursor_plane_atomic_check() within the drm/vmwgfx driver, which validates cursor dimensions only for the legacy update path but not for the modern SVGA_CAP2_CURSOR_MOB path. When an oversized cursor (exceeding SVGA_REG_CURSOR_MAX_DIMENSION or SVGA_REG_MOB_MAX_SIZE) is requested via DRM_IOCTL_MODE_CURSOR2, vmw_cursor_mob_get() returns -EINVAL but this error is silently discarded in vmw_cursor_plane_prepare_fb(). The subsequent vmw_cursor_update_mob() call then attempts to map a NULL MOB backing pointer, causing a kernel oops in vmw_bo_map_and_cache_size(). The attack vector requires DRM master privileges but is reachable without authentication escalation on vulnerable systems. The fix adds dimension and MOB size validation in atomic_check for both MOB-backed cursor paths and properly handles vmw_cursor_mob_get() failures.
Affected products
- Linux Linux kernel before fix (published 2026-08-28)
Timeline
- 2026-08-28: disclosed