CVE-2024-46710

What it actually does

In the Linux kernel drm/vmwgfx driver, concurrent cursor buffer mappings for update and compare operations can race, allowing an active read buffer to be unmapped prematurely and resulting in access to bogus or unmapped buffer contents.

Why it matters to the business

Organizations running affected Linux kernels on systems using vmwgfx graphics may encounter display instability or cursor rendering errors, increasing operational overhead for troubleshooting and patching in environments with broad Linux adoption.

How an attack unfolds

An attacker with local access triggers concurrent kms paths that map the same buffer for update and compare, races the unmap operations, and causes the update path to read from an already-unmapped buffer; no widespread exploitation by named actors has been observed.

How to fix it

Upgrade the Linux kernel to a version containing commit 58a3714db4d9dcaeb9fc4905141e17b9f536c0a5 or later; apply vendor-supplied updates for all affected stable branches.

How to confirm the fix worked

Verify the running kernel contains the referenced commit or is newer than the vulnerable releases; inspect drm/vmwgfx source for the active-map reference count logic and confirm it prevents unmap while count > 0.

Typical attack path

1. Obtain local user access on a Linux system using vmwgfx
2. Trigger concurrent cursor buffer map operations via graphics or kms workloads
3. Force the race between update and compare unmap steps
4. Observe or exploit resulting bogus buffer contents for denial of service or limited information exposure

How to detect it

Review kernel logs for vmwgfx buffer mapping warnings or oops related to cursor buffers; look for repeated map/unmap sequences in graphics driver traces on systems with active cursor updates.

What your security team should do

• Prioritize kernel updates on all systems using vmwgfx graphics
• Monitor upstream stable kernel releases for backports
• Test graphics workloads after patching to confirm cursor stability