The flaw exists in the Linux drm/vmwgfx driver where the function responsible for handling DMA commands calculates the location of a command suffix without confirming that the header size is sufficient to encompass both the command body and the suffix. An undersized header causes the pointer to underflow into the previous command in the pending buffer. During verification, the driver writes to the suffix fields, overwriting previously verified properties such as GMR id or surface id of an earlier command. This results in one command being able to overwrite authenticated parameters of another command, violating the integrity of lower‑level device operations. The weakness involves a buffer under‑read (CWE‑124) that could lead to an out‑of‑bounds write, potentially corrupting other command metadata.

All Linux kernel installations that include an unpatched vmwgfx DRM driver are affected. The advisory does not specify a particular kernel version range, implying that any kernel containing the older vmwgfx module prior to the patch that bounds the DMA command body size remains vulnerable. Users should examine their kernel release notes to determine if the affected driver code is present.

The vulnerability carries a CVSS score of 8.8, indicating high severity, while the EPSS score is less than 1%. The flaw is not listed in the CISA KEV catalog. Based on the description, it is inferred that exploitation would require crafting malicious vmwgfx device commands and is limited to local users who can interact with the device; the attacker would need to send a specifically malformed command sequence to provoke the overflow. Consequently, the risk is high, but the likelihood of exploitation remains low given the limited attack surface. Nonetheless, the potential for unauthorized modification of device operation warrants prompt action.