GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-80700 (GCVE-0-2026-80700)

Vulnerability from cvelistv5 – Published: 2026-08-28 06:53 – Updated: 2026-08-29 06:22
VLAI
Title
drm/vmwgfx: validate external BO copy bounds for both stride paths
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate external BO copy bounds for both stride paths vmw_external_bo_copy() trusts caller-supplied offsets, strides, and heights and operates on imported dma-buf vmaps: - The equal-stride memcpy() bound was clamped after subtracting the offsets from dst_size and src_size; an offset larger than the BO size wraps the unsigned subtraction to a huge value and the resulting memcpy() runs off the end of the vmap. dst_stride * height is also a u32 multiplication that can overflow. - The non-equal-stride row-by-row path had no bound at all. The loop touches bytes through offset + (height - 1) * stride + width_in_bytes, with only a WARN_ON(dst_stride < width_in_bytes), and could likewise step past the end of either mapping. The offsets and strides are derived from STDU/SOU plane state, so a configured CRTC submitting a crafted atomic commit on an imported framebuffer can reach this path. Validate the exact row-copy endpoint against each BO's size up front using check_mul_overflow() and check_add_overflow(). Use the bulk memcpy() path only when width_in_bytes covers the whole stride; otherwise copy one row at a time so partial-row updates near the bottom of a framebuffer remain valid. Also reject zero strides and stride < width_in_bytes, both of which the row-by-row path cannot represent safely.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 9a9716bbbf3dd6b6cbefba3abcc89af8b72631f4 , < 4e0f669e2951b742239c6fe847fcc406fe78748d (git)
Affected: 50f1199250912568606b3778dc56646c10cb7b04 , < e7b25a6011781ebfdbc458552cae6d4156732771 (git)
Affected: 50f1199250912568606b3778dc56646c10cb7b04 , < 042ca38779554687fc32b66a28328e0d9a36c58f (git)
Affected: 50f1199250912568606b3778dc56646c10cb7b04 , < 5e4a2d15637a906cbd9bc98e0bf969f5f713e344 (git)
Affected: 50f1199250912568606b3778dc56646c10cb7b04 , < 706c93c5813caabbb0d0a576c017d15aeec2c113 (git)
Affected: 5c12391ee1ab59cb2f3be3f1f5e6d0fc0c2dc854 (git)
Affected: 6.6.49 , < 6.6.151 (semver)
Affected: 6.10.8 , < 6.11 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.11
Unaffected: 0 , < 6.11 (semver)
Unaffected: 6.6.151 , ≤ 6.6.* (semver)
Unaffected: 6.12.103 , ≤ 6.12.* (semver)
Unaffected: 6.18.44 , ≤ 6.18.* (semver)
Unaffected: 7.1.8 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/vmwgfx/vmwgfx_blit.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4e0f669e2951b742239c6fe847fcc406fe78748d",
              "status": "affected",
              "version": "9a9716bbbf3dd6b6cbefba3abcc89af8b72631f4",
              "versionType": "git"
            },
            {
              "lessThan": "e7b25a6011781ebfdbc458552cae6d4156732771",
              "status": "affected",
              "version": "50f1199250912568606b3778dc56646c10cb7b04",
              "versionType": "git"
            },
            {
              "lessThan": "042ca38779554687fc32b66a28328e0d9a36c58f",
              "status": "affected",
              "version": "50f1199250912568606b3778dc56646c10cb7b04",
              "versionType": "git"
            },
            {
              "lessThan": "5e4a2d15637a906cbd9bc98e0bf969f5f713e344",
              "status": "affected",
              "version": "50f1199250912568606b3778dc56646c10cb7b04",
              "versionType": "git"
            },
            {
              "lessThan": "706c93c5813caabbb0d0a576c017d15aeec2c113",
              "status": "affected",
              "version": "50f1199250912568606b3778dc56646c10cb7b04",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5c12391ee1ab59cb2f3be3f1f5e6d0fc0c2dc854",
              "versionType": "git"
            },
            {
              "lessThan": "6.6.151",
              "status": "affected",
              "version": "6.6.49",
              "versionType": "semver"
            },
            {
              "lessThan": "6.11",
              "status": "affected",
              "version": "6.10.8",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/vmwgfx/vmwgfx_blit.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "6.6.49",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.10.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: validate external BO copy bounds for both stride paths\n\nvmw_external_bo_copy() trusts caller-supplied offsets, strides, and\nheights and operates on imported dma-buf vmaps:\n\n  - The equal-stride memcpy() bound was clamped after subtracting the\n    offsets from dst_size and src_size; an offset larger than the BO\n    size wraps the unsigned subtraction to a huge value and the\n    resulting memcpy() runs off the end of the vmap.  dst_stride *\n    height is also a u32 multiplication that can overflow.\n  - The non-equal-stride row-by-row path had no bound at all.  The\n    loop touches bytes through offset + (height - 1) * stride +\n    width_in_bytes, with only a WARN_ON(dst_stride \u003c width_in_bytes),\n    and could likewise step past the end of either mapping.\n\nThe offsets and strides are derived from STDU/SOU plane state, so a\nconfigured CRTC submitting a crafted atomic commit on an imported\nframebuffer can reach this path.\n\nValidate the exact row-copy endpoint against each BO\u0027s size up front\nusing check_mul_overflow() and check_add_overflow().  Use the bulk\nmemcpy() path only when width_in_bytes covers the whole stride;\notherwise copy one row at a time so partial-row updates near the bottom\nof a framebuffer remain valid.  Also reject zero strides and stride \u003c\nwidth_in_bytes, both of which the row-by-row path cannot represent\nsafely."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is reached only via local DRM KMS ioctls on /dev/dri/card0: DRM_IOCTL_MODE_ATOMIC drives STDU/SOU plane updates that call vmw_bo_cpu_blit() -\u003e vmw_external_bo_copy(); vmwgfx is not exposed through any network, adjacent-radio, or physical-bus interface.\nAC:L - An attacker with DRM master fully controls atomic plane state, damage clips, pitches, and prime-imported framebuffer geometry that derive dst/src offsets, strides, and height; crafted values reliably trigger unsigned wrap or unbounded row copies without races or victim-dependent layout.\nPR:L - DRM_IOCTL_MODE_ATOMIC is gated by DRM_MASTER, not real root; on VMware guests and VDI desktops the logged-in session user holding master (typical video/render group access) can prime-import a dma-buf, configure a CRTC, and submit the malicious atomic commit.\nUI:N - Exploitation requires only the attacker opening the DRM device and issuing crafted atomic commits with an imported framebuffer; no actions by another user such as mounting filesystems or opening files are needed.\nS:U - Out-of-bounds memcpy corrupts adjacent guest-kernel memory around imported dma-buf vmaps and internal display BO mappings, enabling guest-kernel privilege escalation; impact stays within the guest kernel security domain and does not directly cross a VM/host or IOMMU boundary.\nC:H - The bug performs unchecked memcpy from attacker-influenced source mappings past buffer ends (equal-stride unsigned underflow and unbounded row-by-row copies), yielding an out-of-bounds kernel read primitive that can disclose adjacent heap/vmalloc data including kernel pointers.\nI:H - The same unchecked copies write past the end of destination vmaps, providing an out-of-bounds kernel write primitive that can corrupt adjacent objects and be developed into arbitrary memory modification or code execution.\nA:H - Large out-of-bounds memcpy operations can immediately corrupt critical kernel structures or touch unmapped pages, causing kernel oops/panic; the atomic-commit trigger can be repeated to deny availability after reboot."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-29T06:22:20.794Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4e0f669e2951b742239c6fe847fcc406fe78748d"
        },
        {
          "url": "https://git.kernel.org/stable/c/e7b25a6011781ebfdbc458552cae6d4156732771"
        },
        {
          "url": "https://git.kernel.org/stable/c/042ca38779554687fc32b66a28328e0d9a36c58f"
        },
        {
          "url": "https://git.kernel.org/stable/c/5e4a2d15637a906cbd9bc98e0bf969f5f713e344"
        },
        {
          "url": "https://git.kernel.org/stable/c/706c93c5813caabbb0d0a576c017d15aeec2c113"
        }
      ],
      "title": "drm/vmwgfx: validate external BO copy bounds for both stride paths",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80700",
    "datePublished": "2026-08-28T06:53:04.050Z",
    "dateReserved": "2026-08-26T14:34:25.786Z",
    "dateUpdated": "2026-08-29T06:22:20.794Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80700",
      "date": "2026-09-15",
      "epss": "0.00128",
      "percentile": "0.02829"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-80700\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-28T08:16:55.517\",\"lastModified\":\"2026-08-29T07:16:51.807\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/vmwgfx: validate external BO copy bounds for both stride paths\\n\\nvmw_external_bo_copy() trusts caller-supplied offsets, strides, and\\nheights and operates on imported dma-buf vmaps:\\n\\n  - The equal-stride memcpy() bound was clamped after subtracting the\\n    offsets from dst_size and src_size; an offset larger than the BO\\n    size wraps the unsigned subtraction to a huge value and the\\n    resulting memcpy() runs off the end of the vmap.  dst_stride *\\n    height is also a u32 multiplication that can overflow.\\n  - The non-equal-stride row-by-row path had no bound at all.  The\\n    loop touches bytes through offset + (height - 1) * stride +\\n    width_in_bytes, with only a WARN_ON(dst_stride \u003c width_in_bytes),\\n    and could likewise step past the end of either mapping.\\n\\nThe offsets and strides are derived from STDU/SOU plane state, so a\\nconfigured CRTC submitting a crafted atomic commit on an imported\\nframebuffer can reach this path.\\n\\nValidate the exact row-copy endpoint against each BO\u0027s size up front\\nusing check_mul_overflow() and check_add_overflow().  Use the bulk\\nmemcpy() path only when width_in_bytes covers the whole stride;\\notherwise copy one row at a time so partial-row updates near the bottom\\nof a framebuffer remain valid.  Also reject zero strides and stride \u003c\\nwidth_in_bytes, both of which the row-by-row path cannot represent\\nsafely.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/vmwgfx/vmwgfx_blit.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"9a9716bbbf3dd6b6cbefba3abcc89af8b72631f4\",\"lessThan\":\"4e0f669e2951b742239c6fe847fcc406fe78748d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"50f1199250912568606b3778dc56646c10cb7b04\",\"lessThan\":\"e7b25a6011781ebfdbc458552cae6d4156732771\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"50f1199250912568606b3778dc56646c10cb7b04\",\"lessThan\":\"042ca38779554687fc32b66a28328e0d9a36c58f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"50f1199250912568606b3778dc56646c10cb7b04\",\"lessThan\":\"5e4a2d15637a906cbd9bc98e0bf969f5f713e344\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"50f1199250912568606b3778dc56646c10cb7b04\",\"lessThan\":\"706c93c5813caabbb0d0a576c017d15aeec2c113\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5c12391ee1ab59cb2f3be3f1f5e6d0fc0c2dc854\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6.6.49\",\"lessThan\":\"6.6.151\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.10.8\",\"lessThan\":\"6.11\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/vmwgfx/vmwgfx_blit.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.11\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.11\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.151\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.103\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.44\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.8\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/042ca38779554687fc32b66a28328e0d9a36c58f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/4e0f669e2951b742239c6fe847fcc406fe78748d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5e4a2d15637a906cbd9bc98e0bf969f5f713e344\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/706c93c5813caabbb0d0a576c017d15aeec2c113\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e7b25a6011781ebfdbc458552cae6d4156732771\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-31T07:24:50+00:00",
      "cve": "CVE-2026-80700",
      "id": "CVE-2026-80700",
      "initial_release_date": "2026-08-28T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/vmwgfx: validate external BO copy bounds for both stride paths",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80700.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-03T00:04:15Z",
      "cve": "CVE-2026-80700",
      "id": "CVE-2026-80700",
      "initial_release_date": "2026-08-28T16:33:45Z",
      "product_status:known_affected": "30",
      "product_status:known_not_affected": "323",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-80700",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-80700.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.