Executive brief
The VMware GPU driver in the Linux kernel contains a field-assignment bug where boolean values are written to the wrong structure member. This causes the driver to lose track of GPU memory allocation sizes and dirty state, leading to incorrect memory access ranges that can corrupt GPU memory bitmaps or cause kernel instability.
Technical details
In vmwgfx_resource.c, two code paths (vmw_resource_release() and vmw_resource_unbind_list()) incorrectly assign boolean literals (false/true) to res->guest_memory_size instead of the intended res->guest_memory_dirty bitfield. Since guest_memory_size is an unsigned long holding the MOB allocation size, these assignments corrupt it to 0 or 1. Subsequent memory-tracking code reads the corrupted guest_memory_size value when computing dirty page ranges (vmw_bo_dirty_transfer_to_res()) and buffer sizes (vmw_resource_buf_alloc()), producing zero-length or wrap-around access ranges that read or write past bitmap boundaries. The vulnerability requires no authentication or network access; it is triggered during normal GPU resource release and unbind operations in the kernel driver.
Affected products
- Linux Linux kernel multiple versions affected; patches available since 2026-05-05
Timeline
- 2026-08-28: disclosed: CVE-2026-80702 published on NVD
- 2026-05-05: patched: Upstream fix commit 83195b778f2d109a3a4f3ffaba4dce7e4cdb58aa by Zack Rusin
- 2026-08-09: other: Fix merged to stable kernel branches