Executive brief
The vmwgfx graphics driver in the Linux kernel fails to properly release a reference to shared graphics buffer objects when rejecting incompatible import requests from unprivileged user applications. An attacker can repeatedly trigger this condition to leak and exhaust system memory resources, potentially causing denial of service or resource starvation on systems using vmwgfx.
Technical details
The vulnerability is a reference counting bug in the ttm_prime_fd_to_handle() function within drivers/gpu/drm/vmwgfx/ttm_object.c. When an unprivileged renderD client attempts to import a foreign (non-vmwgfx) DMA buffer through the DRM_VMW_GB_SURFACE_REF or DRM_VMW_GB_SURFACE_REF_EXT ioctl paths, the function calls dma_buf_get() to increment the reference count but returns -ENOSYS without calling dma_buf_put() to decrement it when the buffer's ops do not match the expected ttm_object_device ops. This allows any unprivileged local user to repeatedly leak dma_buf references, indefinitely pinning foreign exporter GEM resources and exhausting kernel memory. The fix routes the error path through a goto statement that ensures dma_buf_put() is always invoked.
Affected products
- Linux Linux kernel multiple versions prior to fix (2026-09-04)
Timeline
- 2026-09-04: disclosed: Published on NVD
- 2026-09-04: patched: Fix committed upstream
- 2026-05-05: patched: Upstream commit date
- 2026-09-14: other: Backported to stable kernels