GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-80701 (GCVE-0-2026-80701)

Vulnerability from cvelistv5 – Published: 2026-08-28 06:53 – Updated: 2026-08-28 06:53
VLAI
Title
drm/vmwgfx: enforce cursor size limits for MOB cursors
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: enforce cursor size limits for MOB cursors vmw_cursor_plane_atomic_check() bounds cursor width and height only on the legacy update path; the SVGA_CAP2_CURSOR_MOB path -- the default on modern hosts -- accepts any size. When the requested size exceeds SVGA_REG_CURSOR_MAX_DIMENSION or SVGA_REG_MOB_MAX_SIZE, vmw_cursor_mob_get() returns -EINVAL and leaves vps->cursor.mob NULL. Its return value is then discarded in vmw_cursor_plane_prepare_fb(), so the subsequent vmw_cursor_update_mob() calls vmw_bo_map_and_cache(NULL) and oopses inside vmw_bo_map_and_cache_size() on the tbo.base.size load. Reachable from any DRM master via DRM_IOCTL_MODE_CURSOR2 with a sufficiently large width or height (e.g. cursor_max_dim + 1). Reject oversized cursors in atomic_check for both MOB-backed cursor update types. The MOB byte-size limit only applies to the SVGA_CAP2_CURSOR_MOB path (vmw_cursor_mob_size() returns 0 for GB_ONLY); compute the required MOB size in 64-bit to avoid overflow when very large dimensions are requested. In prepare_fb only call vmw_cursor_mob_get()/_map() for VMW_CURSOR_UPDATE_MOB -- the GB_ONLY path uses bo->map.virtual directly and would otherwise be silently downgraded to NONE on hosts without SVGA_CAP2_CURSOR_MOB (where vmw_cursor_mob_get() always returns -EINVAL). Degrade the update to NONE if vmw_cursor_mob_get() or vmw_cursor_mob_map() fails so the update path does not run with a NULL backing MOB.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 965544150d1cadf0e8f5bb6c13c19697e46e1429 , < 1eb4f796695be39e0b5c4383350033ced9ade703 (git)
Affected: 965544150d1cadf0e8f5bb6c13c19697e46e1429 , < 9109b7935b9c058b75348610ef8437c52f9020e3 (git)
Affected: 965544150d1cadf0e8f5bb6c13c19697e46e1429 , < d5ed8749168ad13c0dbaa8300f68d854b6076966 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.16
Unaffected: 0 , < 6.16 (semver)
Unaffected: 6.18.44 , ≤ 6.18.* (semver)
Unaffected: 7.1.8 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/vmwgfx/vmwgfx_cursor_plane.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1eb4f796695be39e0b5c4383350033ced9ade703",
              "status": "affected",
              "version": "965544150d1cadf0e8f5bb6c13c19697e46e1429",
              "versionType": "git"
            },
            {
              "lessThan": "9109b7935b9c058b75348610ef8437c52f9020e3",
              "status": "affected",
              "version": "965544150d1cadf0e8f5bb6c13c19697e46e1429",
              "versionType": "git"
            },
            {
              "lessThan": "d5ed8749168ad13c0dbaa8300f68d854b6076966",
              "status": "affected",
              "version": "965544150d1cadf0e8f5bb6c13c19697e46e1429",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/vmwgfx/vmwgfx_cursor_plane.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "lessThan": "6.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: enforce cursor size limits for MOB cursors\n\nvmw_cursor_plane_atomic_check() bounds cursor width and height only\non the legacy update path; the SVGA_CAP2_CURSOR_MOB path -- the\ndefault on modern hosts -- accepts any size.  When the requested size\nexceeds SVGA_REG_CURSOR_MAX_DIMENSION or SVGA_REG_MOB_MAX_SIZE,\nvmw_cursor_mob_get() returns -EINVAL and leaves vps-\u003ecursor.mob NULL.\nIts return value is then discarded in vmw_cursor_plane_prepare_fb(),\nso the subsequent vmw_cursor_update_mob() calls\nvmw_bo_map_and_cache(NULL) and oopses inside\nvmw_bo_map_and_cache_size() on the tbo.base.size load.\n\nReachable from any DRM master via DRM_IOCTL_MODE_CURSOR2 with a\nsufficiently large width or height (e.g. cursor_max_dim + 1).\n\nReject oversized cursors in atomic_check for both MOB-backed cursor\nupdate types.  The MOB byte-size limit only applies to the\nSVGA_CAP2_CURSOR_MOB path (vmw_cursor_mob_size() returns 0 for\nGB_ONLY); compute the required MOB size in 64-bit to avoid overflow\nwhen very large dimensions are requested.\n\nIn prepare_fb only call vmw_cursor_mob_get()/_map() for\nVMW_CURSOR_UPDATE_MOB -- the GB_ONLY path uses bo-\u003emap.virtual\ndirectly and would otherwise be silently downgraded to NONE on hosts\nwithout SVGA_CAP2_CURSOR_MOB (where vmw_cursor_mob_get() always\nreturns -EINVAL).  Degrade the update to NONE if vmw_cursor_mob_get()\nor vmw_cursor_mob_map() fails so the update path does not run with a\nNULL backing MOB."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-28T06:53:04.652Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1eb4f796695be39e0b5c4383350033ced9ade703"
        },
        {
          "url": "https://git.kernel.org/stable/c/9109b7935b9c058b75348610ef8437c52f9020e3"
        },
        {
          "url": "https://git.kernel.org/stable/c/d5ed8749168ad13c0dbaa8300f68d854b6076966"
        }
      ],
      "title": "drm/vmwgfx: enforce cursor size limits for MOB cursors",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80701",
    "datePublished": "2026-08-28T06:53:04.652Z",
    "dateReserved": "2026-08-26T14:34:25.786Z",
    "dateUpdated": "2026-08-28T06:53:04.652Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80701",
      "date": "2026-09-15",
      "epss": "0.00166",
      "percentile": "0.06171"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-80701\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-28T08:16:55.640\",\"lastModified\":\"2026-08-28T08:16:55.640\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/vmwgfx: enforce cursor size limits for MOB cursors\\n\\nvmw_cursor_plane_atomic_check() bounds cursor width and height only\\non the legacy update path; the SVGA_CAP2_CURSOR_MOB path -- the\\ndefault on modern hosts -- accepts any size.  When the requested size\\nexceeds SVGA_REG_CURSOR_MAX_DIMENSION or SVGA_REG_MOB_MAX_SIZE,\\nvmw_cursor_mob_get() returns -EINVAL and leaves vps-\u003ecursor.mob NULL.\\nIts return value is then discarded in vmw_cursor_plane_prepare_fb(),\\nso the subsequent vmw_cursor_update_mob() calls\\nvmw_bo_map_and_cache(NULL) and oopses inside\\nvmw_bo_map_and_cache_size() on the tbo.base.size load.\\n\\nReachable from any DRM master via DRM_IOCTL_MODE_CURSOR2 with a\\nsufficiently large width or height (e.g. cursor_max_dim + 1).\\n\\nReject oversized cursors in atomic_check for both MOB-backed cursor\\nupdate types.  The MOB byte-size limit only applies to the\\nSVGA_CAP2_CURSOR_MOB path (vmw_cursor_mob_size() returns 0 for\\nGB_ONLY); compute the required MOB size in 64-bit to avoid overflow\\nwhen very large dimensions are requested.\\n\\nIn prepare_fb only call vmw_cursor_mob_get()/_map() for\\nVMW_CURSOR_UPDATE_MOB -- the GB_ONLY path uses bo-\u003emap.virtual\\ndirectly and would otherwise be silently downgraded to NONE on hosts\\nwithout SVGA_CAP2_CURSOR_MOB (where vmw_cursor_mob_get() always\\nreturns -EINVAL).  Degrade the update to NONE if vmw_cursor_mob_get()\\nor vmw_cursor_mob_map() fails so the update path does not run with a\\nNULL backing MOB.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/vmwgfx/vmwgfx_cursor_plane.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"965544150d1cadf0e8f5bb6c13c19697e46e1429\",\"lessThan\":\"1eb4f796695be39e0b5c4383350033ced9ade703\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"965544150d1cadf0e8f5bb6c13c19697e46e1429\",\"lessThan\":\"9109b7935b9c058b75348610ef8437c52f9020e3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"965544150d1cadf0e8f5bb6c13c19697e46e1429\",\"lessThan\":\"d5ed8749168ad13c0dbaa8300f68d854b6076966\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/vmwgfx/vmwgfx_cursor_plane.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.16\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.16\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.44\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.8\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1eb4f796695be39e0b5c4383350033ced9ade703\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9109b7935b9c058b75348610ef8437c52f9020e3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d5ed8749168ad13c0dbaa8300f68d854b6076966\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-31T16:11:51+00:00",
      "cve": "CVE-2026-80701",
      "id": "CVE-2026-80701",
      "initial_release_date": "2026-08-28T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/vmwgfx: enforce cursor size limits for MOB cursors",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80701.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-03T16:25:43Z",
      "cve": "CVE-2026-80701",
      "id": "CVE-2026-80701",
      "initial_release_date": "2026-08-28T16:33:43Z",
      "product_status:known_not_affected": "353",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-80701",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-80701.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.