Description
In the Linux kernel, the following vulnerability has been resolved:

drm/vmwgfx: enforce cursor size limits for MOB cursors

vmw_cursor_plane_atomic_check() bounds cursor width and height only
on the legacy update path; the SVGA_CAP2_CURSOR_MOB path -- the
default on modern hosts -- accepts any size. When the requested size
exceeds SVGA_REG_CURSOR_MAX_DIMENSION or SVGA_REG_MOB_MAX_SIZE,
vmw_cursor_mob_get() returns -EINVAL and leaves vps->cursor.mob NULL.
Its return value is then discarded in vmw_cursor_plane_prepare_fb(),
so the subsequent vmw_cursor_update_mob() calls
vmw_bo_map_and_cache(NULL) and oopses inside
vmw_bo_map_and_cache_size() on the tbo.base.size load.

Reachable from any DRM master via DRM_IOCTL_MODE_CURSOR2 with a
sufficiently large width or height (e.g. cursor_max_dim + 1).

Reject oversized cursors in atomic_check for both MOB-backed cursor
update types. The MOB byte-size limit only applies to the
SVGA_CAP2_CURSOR_MOB path (vmw_cursor_mob_size() returns 0 for
GB_ONLY); compute the required MOB size in 64-bit to avoid overflow
when very large dimensions are requested.

In prepare_fb only call vmw_cursor_mob_get()/_map() for
VMW_CURSOR_UPDATE_MOB -- the GB_ONLY path uses bo->map.virtual
directly and would otherwise be silently downgraded to NONE on hosts
without SVGA_CAP2_CURSOR_MOB (where vmw_cursor_mob_get() always
returns -EINVAL). Degrade the update to NONE if vmw_cursor_mob_get()
or vmw_cursor_mob_map() fails so the update path does not run with a
NULL backing MOB.
Published: 2026-08-28
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Kernel Oops / Denial of Service
Action: Apply Patch
AI Analysis

Impact

The vulnerability resides in the VMware GPU driver (vmwgfx) within the Linux kernel. When a cursor size larger than the hardware limits is requested via the DRM_IOCTL_MODE_CURSOR2 ioctl, the vmw_cursor_mob_get() routine returns an error but this error is ignored downstream. The vmw_cursor_update_mob() function then attempts to map a null backing object, causing vmw_bo_map_and_cache to dereference a null pointer and trigger a kernel oops. The kernel crash results in the system rebooting, effectively causing a denial of service to all users of the affected device.

Affected Systems

All Linux kernel builds that include the vmwgfx DRM driver prior to the patch are vulnerable. Distribution and version details are not specified in the advisory, but any kernel that incorporates the unbounded cursor handling code in vmwgfx remains affected until the patch that enforces cursor size limits is applied. VMware host or guest systems that expose the DRM cursor API to user processes are the primary users of the vulnerable code path.

Risk and Exploitability

The flaw is a local exploit requiring a user to have DRM master privileges, which typically means root or a user granted access to the graphics device. The CVSS score of 5.5 reflects a moderate severity due to the denial‑of‑service impact. The EPSS score is shown as <1%, indicating a very low but non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker can trigger the crash by sending an oversized cursor size using DRM_IOCTL_MODE_CURSOR2, causing the kernel to reboot and denying service to the machine and all its users.

Generated by OpenCVE AI on September 2, 2026 at 04:52 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the kernel patch that enforces cursor size limits in vmwgfx
  • Restrict access to DRM_IOCTL_MODE_CURSOR2 so that only privileged users or system processes can invoke it
  • Configure any applications that use custom cursors to enforce a maximum size that aligns with hardware limits to prevent accidental oversized requests

Generated by OpenCVE AI on September 2, 2026 at 04:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 01 Sep 2026 22:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-190
CWE-20

Tue, 01 Sep 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Fri, 28 Aug 2026 11:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-190
CWE-20
CWE-476

Fri, 28 Aug 2026 07:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: enforce cursor size limits for MOB cursors vmw_cursor_plane_atomic_check() bounds cursor width and height only on the legacy update path; the SVGA_CAP2_CURSOR_MOB path -- the default on modern hosts -- accepts any size. When the requested size exceeds SVGA_REG_CURSOR_MAX_DIMENSION or SVGA_REG_MOB_MAX_SIZE, vmw_cursor_mob_get() returns -EINVAL and leaves vps->cursor.mob NULL. Its return value is then discarded in vmw_cursor_plane_prepare_fb(), so the subsequent vmw_cursor_update_mob() calls vmw_bo_map_and_cache(NULL) and oopses inside vmw_bo_map_and_cache_size() on the tbo.base.size load. Reachable from any DRM master via DRM_IOCTL_MODE_CURSOR2 with a sufficiently large width or height (e.g. cursor_max_dim + 1). Reject oversized cursors in atomic_check for both MOB-backed cursor update types. The MOB byte-size limit only applies to the SVGA_CAP2_CURSOR_MOB path (vmw_cursor_mob_size() returns 0 for GB_ONLY); compute the required MOB size in 64-bit to avoid overflow when very large dimensions are requested. In prepare_fb only call vmw_cursor_mob_get()/_map() for VMW_CURSOR_UPDATE_MOB -- the GB_ONLY path uses bo->map.virtual directly and would otherwise be silently downgraded to NONE on hosts without SVGA_CAP2_CURSOR_MOB (where vmw_cursor_mob_get() always returns -EINVAL). Degrade the update to NONE if vmw_cursor_mob_get() or vmw_cursor_mob_map() fails so the update path does not run with a NULL backing MOB.
Title drm/vmwgfx: enforce cursor size limits for MOB cursors
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-28T06:53:04.652Z

Reserved: 2026-08-26T14:34:25.786Z

Link: CVE-2026-80701

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-28T08:16:55.640

Modified: 2026-08-28T08:16:55.640

Link: CVE-2026-80701

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-08-28T00:00:00Z

Links: CVE-2026-80701 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-02T05:00:13Z

Weaknesses