This vulnerability manifests as a buffer overflow and integer overflow in the vmwgfx driver’s vmw_external_bo_copy function, allowing an attacker to supply unbounded offsets, strides, and heights. When copying data from an imported dma-buf, unchecked arithmetic can overflow, causing memcpy to run beyond the allocated vmap and potentially corrupt kernel memory. This out‑of‑bounds kernel memory write can overwrite any data in the kernel address space, which could enable a local attacker to gain elevated privileges or execute arbitrary code.

All Linux kernel releases that include the vmwgfx DRM subsystem before the patch. This applies to any system that uses the vmwgfx interface. No product‑specific version details are provided, so all affected kernels should be considered until the change is applied.

The CVSS score of 7.8 indicates high severity, and the EPSS score is < 1%, suggesting a very low likelihood of exploitation. The lack of bounds checks indicates significant risk, as unchecked arithmetic may lead to out‑of‑bounds memory writes. The attacker must have the ability to submit a crafted atomic commit on an imported framebuffer, meaning local access to the vmwgfx device is required. If an attacker can control the framebuffer parameters, they can trigger the overflow to corrupt kernel memory. The vulnerability is not listed in CISA KEV, but it poses a serious risk in environments that rely on untrusted framebuffer imports.