SB2026082871 - Improper input validation in Linux kernel drm vmwgfx driver

Description

This security bulletin contains information about 1 vulnerability.

1) Improper input validation (CVE-ID: CVE-2026-80701)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in vmw_cursor_plane_atomic_check() and the vmwgfx cursor update path when handling DRM_IOCTL_MODE_CURSOR2 requests with oversized cursor dimensions. A local user can send a specially crafted ioctl request to cause a denial of service.

Exploitation is reachable by a DRM master, and the crash occurs when a NULL backing MOB is later dereferenced in the MOB cursor update path.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/1eb4f796695be39e0b5c4383350033ced9ade703
• https://git.kernel.org/stable/c/9109b7935b9c058b75348610ef8437c52f9020e3
• https://git.kernel.org/stable/c/d5ed8749168ad13c0dbaa8300f68d854b6076966