CVE-2026-99002

What it actually does

Missing validation of userspace-supplied pitch value alongside box dimensions allows out-of-bounds reads when copying cursor data in the vmwgfx driver.

Why it matters to the business

Local attackers on affected Linux systems can read kernel memory or crash the graphics subsystem, risking data exposure and service disruption on VMware-virtualized workloads.

How an attack unfolds

An attacker with local access supplies crafted pitch and box parameters through the graphics driver interface to bypass bounds checks during cursor snooping and trigger out-of-bounds reads.

How to fix it

Update the Linux kernel to a version containing the pitch validation fix in drm/vmwgfx; rebuild and reboot if using a custom kernel.

How to confirm the fix worked

Inspect the drm/vmwgfx source for the added pitch-and-box validation check before the copy operation; confirm the vulnerable path is no longer reachable.

Typical attack path

1. Obtain local user access on a system using the vmwgfx driver
2. Locate and invoke the relevant ioctl or sysfs interface that accepts pitch and box values
3. Supply malicious pitch larger than expected surface dimensions
4. Trigger cursor snooping operation to perform the out-of-bounds read
5. Exfiltrate leaked kernel memory or induce denial of service

How to detect it

Review kernel logs for vmwgfx-related warnings or oops messages around cursor handling; correlate with unexpected process crashes in graphics contexts.

What your security team should do

• Apply the upstream kernel patch within the next maintenance window given the local attack vector and high CVSS
• Restrict unprivileged local accounts where possible until patched
• Monitor vendor advisories for distribution-specific backports