Cloudanix VulnDB

CVE-2026-80887

None

CVSS

—

EPSS

0.2%

Published

Sep 4, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A math error in the Linux driver handling VMware graphics shaders let attackers slip past size checks and send bad memory addresses onward, which could crash or corrupt graphics operations.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Improper Input Validation
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Integer wraparound in vmw_shader_define validation of user-supplied size+offset against backing buffer size allows an unbounded offset to be stored in res->guest_memory_offset and forwarded to host SVGA shader-create commands.

Why it matters to the business

Attackers with access to the graphics driver can trigger invalid memory operations in the VMware virtual graphics stack, risking guest crashes, host resource corruption, or escalation within virtualized environments.

How an attack unfolds

An attacker invokes the drm_vmw_shader_create ioctl with an offset near U64_MAX; the unchecked addition wraps, the malformed check passes, the guest_memory_offset is stored without bounds, and the value is sent to the host, bypassing intended buffer limits.

How to fix it

Apply the upstream kernel patch replacing the vulnerable comparison with check_add_overflow() in vmw_shader_define; rebuild and deploy the fixed kernel image.

How to confirm the fix worked

Inspect the vmw_shader_define function in the running kernel source or binary for the presence of check_add_overflow on the size+offset calculation; confirm the absence of the original direct comparison.

Typical attack path

  1. Locate a system exposing the vmwgfx DRM device and ioctl interface
  2. Craft a drm_vmw_shader_create_arg structure containing a size+offset pair that wraps on addition
  3. Issue the ioctl to vmw_shader_define
  4. Observe the resulting guest_memory_offset forwarded in SVGA commands to the hypervisor

How to detect it

Review kernel audit logs or ftrace output for drm_vmw_shader_create calls with unusually large offset values; correlate with subsequent SVGA command submissions containing suspicious guest_memory_offset values.

What your security team should do

  • Prioritize kernel updates containing the overflow check fix across all systems using vmwgfx
  • Restrict untrusted access to the DRM render node until patched
  • Monitor for new stable kernel releases that include this change

The record

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: use check_add_overflow for shader size+offset bound vmw_shader_define() validates the user-supplied shader window against its backing buffer with (u64)buffer->tbo.base.size < (u64)size + (u64)offset drm_vmw_shader_create_arg::offset is __u64 in the uapi; when it is near U64_MAX the unsigned addition wraps and the resulting tiny value passes the check. The unbounded offset is then stored in res->guest_memory_offset and forwarded to host SVGA shader-create commands. Use check_add_overflow() to detect the wrap and compare the resulting endpoint against the buffer size.

Affected packages

Ecosystem Package Introduced Fixed