CVE-2024-35810

What it actually does

Use-after-free in vmwgfx where buffer objects in vmw_plane_state are invalidated by cleanup dispatched while an atomic update remains active, instead of relying on map_and_cache lifetime management.

Why it matters to the business

Kernel crashes on affected Linux systems using VMware graphics can cause system instability and downtime in virtual desktop or graphics workloads.

How an attack unfolds

An attacker with local access triggers cursor operations that overlap cleanup with an active atomic update, resulting in invalid memory access and kernel oops.

How to fix it

Upgrade the Linux kernel to the fixed commit 86cb706a40b7e6b2221ee49a298a65ad9b46c02d or a later stable release containing the patch.

How to confirm the fix worked

Confirm the fix is present in drm/vmwgfx source and run IGT kms_cursor_legacy tests to verify no oopses occur.

Typical attack path

1. Obtain local access to a system running the vulnerable vmwgfx driver
2. Perform cursor legacy operations that dispatch cleanup concurrently with atomic updates
3. Trigger the use-after-free condition leading to kernel crash or potential escalation

How to detect it

Search kernel logs for oopses mentioning vmwgfx, vmw_plane_state, or cursor memory during atomic updates.

What your security team should do

• Apply the kernel update containing commit 86cb706a40b7e6b2221ee49a298a65ad9b46c02d as soon as possible
• Review system logs for vmwgfx-related oopses
• Limit untrusted local access until systems are patched