The issue resides in the vmw_translate_ptr functions of the Linux kernel drm/vmwgfx driver. A change in the lookup function caused the error path to incorrectly return the PTR_ERR of an uninitialized pointer, resulting in the functions reporting success when they had actually failed. This flaw can lead to uninitialized variable usage and out‑of‑bounds memory accesses within the kernel, creating an opportunity for memory corruption that could potentially allow privilege escalation or denial of service.

The vulnerability applies to any system running the Linux kernel with the drm/vmwgfx driver, which includes Linux guests in VMware virtualized environments. No specific kernel version range is listed, but all kernels lacking the recent patches that corrected the return semantics are affected.

With a CVSS score of 7.8 the vulnerability is classified as High severity. The EPSS score of less than 1% indicates a low probability of exploitation in the wild at present, and the issue is not in the CISA KEV catalog. Attackers would need to exploit the driver’s interface, likely requiring local or remote privilege escalated access to the guest OS to trigger the buggy function paths. Given the kernel context, successful exploitation could lead to arbitrary code execution or a crash of the host or guest system.