This vulnerability manifests as a buffer overflow and integer overflow (CWE-119, CWE-680) in the vmwgfx driver’s vmw_external_bo_copy function, allowing an attacker to supply unbounded offsets, strides, and heights. When copying data from an imported dma-buf, unchecked arithmetic can overflow, causing memcpy to write beyond the allocated vmap and potentially corrupt kernel memory. This out‑of‑bounds kernel memory write can corrupt any data in the kernel address space, potentially enabling a local attacker to gain elevated privileges or execute arbitrary code.

All Linux kernel releases that include the vmwgfx DRM subsystem before the patch. This applies to any system that uses the vmwgfx interface. No product‑specific version details are provided, so all affected kernels should be considered until the change is applied.

The CVSS and EPSS scores are not published, but the lack of bounds checks indicates high severity. The attacker must have the ability to submit a crafted atomic commit on an imported framebuffer, meaning local access to the vmwgfx device is required. If an attacker can control the framebuffer parameters, they can trigger the overflow to corrupt kernel memory. The vulnerability is not currently listed in CISA KEV, but it poses a serious risk in environments that rely on untrusted framebuffer imports.