CVE-2026-80700
High · 7.8CVSS
7.8
EPSS
0.1%
Published
Aug 28, 2026
CISA due date
—
Cloudanix analysis
A bug in the graphics handling code lets a local user send bad display settings that can corrupt memory and potentially take over the system.
- Exploitation
- Local Privilege
- Attacker needs
- Low Privilege
- Complexity
- Low
- Impact
- Full Compromise
- Component
- OS kernel
- Class
- Memory Corruption
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
The vmw_external_bo_copy function in the vmwgfx driver performs unchecked memcpy and row-by-row copies on imported dma-buf vmaps using attacker-controlled offsets, strides, and heights from STDU/SOU plane state; unsigned subtraction and multiplication can wrap or exceed buffer sizes, causing out-of-bounds memory access.
Why it matters to the business
Local users on systems using the vmwgfx driver can trigger memory corruption that may lead to crashes, privilege escalation, or data exposure in graphics or virtual desktop workloads.
How an attack unfolds
An attacker with local access imports a dma-buf framebuffer, configures a CRTC with malicious plane state containing oversized offsets or strides, and submits an atomic commit that reaches vmw_external_bo_copy, resulting in out-of-bounds reads or writes during the copy operation.
How to fix it
Update the Linux kernel to a version containing the upstream fix that adds check_mul_overflow and check_add_overflow validation, rejects zero or undersized strides, and limits bulk copies to safe cases.
How to confirm the fix worked
Verify the presence of the bounds-checking logic (check_add_overflow, check_mul_overflow, stride validation) in vmw_external_bo_copy after applying the kernel update; re-test with crafted atomic commits to confirm rejection of invalid parameters.
Typical attack path
- Gain local user access on a Linux system using vmwgfx
- Create or import a dma-buf framebuffer object
- Prepare crafted STDU/SOU plane state with invalid offsets, strides, or heights
- Submit an atomic commit through the DRM interface to trigger the copy path
- Achieve out-of-bounds memory access for corruption or further exploitation
How to detect it
Review kernel logs for vmwgfx-related oops, warnings on stride or offset values, or crashes during atomic commits involving imported framebuffers; correlate with unusual DRM atomic commit activity from local processes.
What your security team should do
- Prioritize kernel updates for systems exposing vmwgfx to untrusted local users
- Restrict local access and DMA-BUF import capabilities where possible
- Monitor for kernel oops or crashes involving vmwgfx during graphics operations
The record
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate external BO copy bounds for both stride paths vmw_external_bo_copy() trusts caller-supplied offsets, strides, and heights and operates on imported dma-buf vmaps: - The equal-stride memcpy() bound was clamped after subtracting the offsets from dst_size and src_size; an offset larger than the BO size wraps the unsigned subtraction to a huge value and the resulting memcpy() runs off the end of the vmap. dst_stride * height is also a u32 multiplication that can overflow. - The non-equal-stride row-by-row path had no bound at all. The loop touches bytes through offset + (height - 1) * stride + width_in_bytes, with only a WARN_ON(dst_stride < width_in_bytes), and could likewise step past the end of either mapping. The offsets and strides are derived from STDU/SOU plane state, so a configured CRTC submitting a crafted atomic commit on an imported framebuffer can reach this path. Validate the exact row-copy endpoint against each BO's size up front using check_mul_overflow() and check_add_overflow(). Use the bulk memcpy() path only when width_in_bytes covers the whole stride; otherwise copy one row at a time so partial-row updates near the bottom of a framebuffer remain valid. Also reject zero strides and stride < width_in_bytes, both of which the row-by-row path cannot represent safely.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|