GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-80702 (GCVE-0-2026-80702)

Vulnerability from cvelistv5 – Published: 2026-08-28 06:53 – Updated: 2026-08-29 06:22
VLAI
Title
drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size Two sites in vmwgfx_resource.c assign boolean literals to res->guest_memory_size, which is an unsigned long allocation-size field; the intended target is the adjacent res->guest_memory_dirty bitfield. After the assignments the field holds 0 or 1 instead of the resource's MOB allocation size: - vmw_resource_release() writes 0 (false), and - vmw_resource_unbind_list() writes 1 (true). Subsequent revalidation paths read guest_memory_size when computing the dirty page range (vmw_bo_dirty_transfer_to_res()) and the buffer allocation size (vmw_resource_buf_alloc()), producing zero-length walks or wrap-around ranges that read or write past the MOB bitmap. The dirty-tracking intent of the original code (mark the resource as dirtied since the last sync) is also lost, since guest_memory_dirty is never updated. Rename both assignments to guest_memory_dirty.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 668b206601c5f5063e03b76784a0d3024fa2b249 , < 21bbe38faee4a195d33a93e3908e307807f7745d (git)
Affected: 668b206601c5f5063e03b76784a0d3024fa2b249 , < 9d6cbb76fe9cd760351f6b0b20f1bf788eab8fa6 (git)
Affected: 668b206601c5f5063e03b76784a0d3024fa2b249 , < 282f261cb035e5f01a486f76d356b7e9dbfba73f (git)
Affected: 668b206601c5f5063e03b76784a0d3024fa2b249 , < 3b2bb16a5b622867140d69925db411ac8ecb3b2b (git)
Affected: 668b206601c5f5063e03b76784a0d3024fa2b249 , < 83195b778f2d109a3a4f3ffaba4dce7e4cdb58aa (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.4
Unaffected: 0 , < 6.4 (semver)
Unaffected: 6.6.151 , ≤ 6.6.* (semver)
Unaffected: 6.12.103 , ≤ 6.12.* (semver)
Unaffected: 6.18.44 , ≤ 6.18.* (semver)
Unaffected: 7.1.8 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/vmwgfx/vmwgfx_resource.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "21bbe38faee4a195d33a93e3908e307807f7745d",
              "status": "affected",
              "version": "668b206601c5f5063e03b76784a0d3024fa2b249",
              "versionType": "git"
            },
            {
              "lessThan": "9d6cbb76fe9cd760351f6b0b20f1bf788eab8fa6",
              "status": "affected",
              "version": "668b206601c5f5063e03b76784a0d3024fa2b249",
              "versionType": "git"
            },
            {
              "lessThan": "282f261cb035e5f01a486f76d356b7e9dbfba73f",
              "status": "affected",
              "version": "668b206601c5f5063e03b76784a0d3024fa2b249",
              "versionType": "git"
            },
            {
              "lessThan": "3b2bb16a5b622867140d69925db411ac8ecb3b2b",
              "status": "affected",
              "version": "668b206601c5f5063e03b76784a0d3024fa2b249",
              "versionType": "git"
            },
            {
              "lessThan": "83195b778f2d109a3a4f3ffaba4dce7e4cdb58aa",
              "status": "affected",
              "version": "668b206601c5f5063e03b76784a0d3024fa2b249",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/vmwgfx/vmwgfx_resource.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size\n\nTwo sites in vmwgfx_resource.c assign boolean literals to\nres-\u003eguest_memory_size, which is an unsigned long allocation-size\nfield; the intended target is the adjacent res-\u003eguest_memory_dirty\nbitfield.  After the assignments the field holds 0 or 1 instead of\nthe resource\u0027s MOB allocation size:\n\n  - vmw_resource_release()       writes 0 (false), and\n  - vmw_resource_unbind_list()   writes 1 (true).\n\nSubsequent revalidation paths read guest_memory_size when computing\nthe dirty page range (vmw_bo_dirty_transfer_to_res()) and the buffer\nallocation size (vmw_resource_buf_alloc()), producing zero-length\nwalks or wrap-around ranges that read or write past the MOB bitmap.\nThe dirty-tracking intent of the original code (mark the resource as\ndirtied since the last sync) is also lost, since guest_memory_dirty\nis never updated.\n\nRename both assignments to guest_memory_dirty."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Reachable only via local DRM ioctls on the vmwgfx render node (surface/context create-unref, DRM_VMW_EXECBUF, synccpu); vmw_resource_unbind_list runs from vmw_bo_move_notify during MOB eviction, not from any network or physical bus.\nAC:L - An unprivileged attacker controls the full GPU resource lifecycle and can force MOB moves plus subsequent revalidation (execbuf, memory pressure, destroy paths) to clobber guest_memory_size to 0/1 without races or victim-dependent heap layout.\nPR:L - Entry ioctls use DRM_RENDER_ALLOW, so any local user with access to /dev/dri/renderD* on a VMware SVGA guest can trigger vmw_resource_release or vmw_resource_unbind_list and the follow-on validate/dirty paths without init-namespace root.\nUI:N - Exploitation requires only the attacker opening the DRM render device and issuing crafted GPU resource operations; no additional actions by another user or administrator are needed.\nS:U - The bug corrupts guest-kernel vmwgfx MOB dirty-tracking and heap metadata during resource revalidation; impact is confined to the guest kernel security domain and does not directly cross a VM/host or IOMMU boundary.\nC:H - Clobbering guest_memory_size to 0 or 1 breaks dirty page-range math in vmw_bo_dirty_transfer_to_res and vmw_resource_buf_alloc, producing zero-length or wrap-around walks that read past the MOB dirty bitmap and adjacent kernel heap memory.\nI:H - The same corrupted size drives out-of-bounds bitmap_clear and dirty_sync operations past the MOB bitmap and undersized reallocations, yielding a kernel heap write primitive that can be leveraged for guest privilege escalation.\nA:H - Out-of-bounds MOB bitmap access and mis-sized buffer reallocation during revalidation after unbind or release can kernel-oops or panic the guest, providing a reliable denial-of-service against the VM."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-29T06:22:22.050Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/21bbe38faee4a195d33a93e3908e307807f7745d"
        },
        {
          "url": "https://git.kernel.org/stable/c/9d6cbb76fe9cd760351f6b0b20f1bf788eab8fa6"
        },
        {
          "url": "https://git.kernel.org/stable/c/282f261cb035e5f01a486f76d356b7e9dbfba73f"
        },
        {
          "url": "https://git.kernel.org/stable/c/3b2bb16a5b622867140d69925db411ac8ecb3b2b"
        },
        {
          "url": "https://git.kernel.org/stable/c/83195b778f2d109a3a4f3ffaba4dce7e4cdb58aa"
        }
      ],
      "title": "drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80702",
    "datePublished": "2026-08-28T06:53:05.253Z",
    "dateReserved": "2026-08-26T14:34:25.786Z",
    "dateUpdated": "2026-08-29T06:22:22.050Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80702",
      "date": "2026-09-16",
      "epss": "0.00128",
      "percentile": "0.02853"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-11T01:54:55.000Z",
      "cve": "CVE-2026-80702",
      "id": "msrc_CVE-2026-80702",
      "initial_release_date": "2026-08-29T01:02:53.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-80702.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-80702\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-28T08:16:55.740\",\"lastModified\":\"2026-08-29T07:16:51.943\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size\\n\\nTwo sites in vmwgfx_resource.c assign boolean literals to\\nres-\u003eguest_memory_size, which is an unsigned long allocation-size\\nfield; the intended target is the adjacent res-\u003eguest_memory_dirty\\nbitfield.  After the assignments the field holds 0 or 1 instead of\\nthe resource\u0027s MOB allocation size:\\n\\n  - vmw_resource_release()       writes 0 (false), and\\n  - vmw_resource_unbind_list()   writes 1 (true).\\n\\nSubsequent revalidation paths read guest_memory_size when computing\\nthe dirty page range (vmw_bo_dirty_transfer_to_res()) and the buffer\\nallocation size (vmw_resource_buf_alloc()), producing zero-length\\nwalks or wrap-around ranges that read or write past the MOB bitmap.\\nThe dirty-tracking intent of the original code (mark the resource as\\ndirtied since the last sync) is also lost, since guest_memory_dirty\\nis never updated.\\n\\nRename both assignments to guest_memory_dirty.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/vmwgfx/vmwgfx_resource.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"668b206601c5f5063e03b76784a0d3024fa2b249\",\"lessThan\":\"21bbe38faee4a195d33a93e3908e307807f7745d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"668b206601c5f5063e03b76784a0d3024fa2b249\",\"lessThan\":\"9d6cbb76fe9cd760351f6b0b20f1bf788eab8fa6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"668b206601c5f5063e03b76784a0d3024fa2b249\",\"lessThan\":\"282f261cb035e5f01a486f76d356b7e9dbfba73f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"668b206601c5f5063e03b76784a0d3024fa2b249\",\"lessThan\":\"3b2bb16a5b622867140d69925db411ac8ecb3b2b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"668b206601c5f5063e03b76784a0d3024fa2b249\",\"lessThan\":\"83195b778f2d109a3a4f3ffaba4dce7e4cdb58aa\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/vmwgfx/vmwgfx_resource.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.4\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.4\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.151\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.103\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.44\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.8\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/21bbe38faee4a195d33a93e3908e307807f7745d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/282f261cb035e5f01a486f76d356b7e9dbfba73f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3b2bb16a5b622867140d69925db411ac8ecb3b2b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/83195b778f2d109a3a4f3ffaba4dce7e4cdb58aa\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9d6cbb76fe9cd760351f6b0b20f1bf788eab8fa6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-01T10:38:53+00:00",
      "cve": "CVE-2026-80702",
      "id": "CVE-2026-80702",
      "initial_release_date": "2026-08-28T00:00:00+00:00",
      "product_status:known_affected": "246",
      "product_status:known_not_affected": "28",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80702.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-03T00:04:13Z",
      "cve": "CVE-2026-80702",
      "id": "CVE-2026-80702",
      "initial_release_date": "2026-08-28T16:33:41Z",
      "product_status:known_affected": "30",
      "product_status:known_not_affected": "323",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-80702",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-80702.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.