CVE-2026-80700

The vmwgfx KMS driver in the Linux kernel trusts caller-supplied offsets, strides and heights in vmw_external_bo_copy(), which copies data to and from imported dma-buf memory mappings; an offset larger than the buffer size underflows an unsigned size calculation, the stride-times-height multiply can overflow a 32-bit value, and the unequal-stride row-by-row copy path has no end-of-buffer bound at all. As a result, a bulk memcpy or row loop can run past the end of the mapped buffer, corrupting adjacent kernel memory or exposing kernel data. A local attacker triggers this by configuring a CRTC and submitting a crafted atomic commit that uses an imported (dma-buf) framebuffer, requiring only ordinary local privileges. Any Linux system running as a VMware guest with the vmwgfx driver active (VMs on ESXi, Workstation or Fusion) is potentially affected. Successful exploitation yields kernel memory disclosure or corruption (CVSS rates confidentiality, integrity and availability all high), potentially enabling local privilege escalation or a crash; no public PoC, KEV listing or in-the-wild exploitation is known, and EPSS puts 30-day exploitation probability at about 0.1%.

What to do: Update to a kernel that includes the upstream drm/vmwgfx fix, or install your vendor's patched kernel package as soon as it is released (no fixed version number is given in the source data). Check whether the driver is loaded on VMware guests (lsmod | grep vmwgfx); where untrusted local users or containers can access /dev/dri, restrict DRM device access or avoid imported dma-buf framebuffers until patched. With no public PoC or known exploitation, patching on a normal cycle is acceptable for single-user workstations, but prioritize multi-tenant hosts and VMs exposed to untrusted local code.