In the Linux kernel, a bug in the vmwgfx driver causes boolean values to be written to an unsigned long field that holds resource allocation size, instead of setting the intended dirty‑status bitfield. The incorrect assignments leave the size field with the values 0 or 1, and subsequent logic that relies on this size for walking page ranges or allocating buffers uses the corrupted value. This can result in zero‑length walks or wrap‑around ranges that read or write past the intended memory bitmap, potentially corrupting kernel memory or causing a crash. The original intent to flag a resource as dirty is lost, thereby degrading the driver’s functionality.

The issue appears in any Linux kernel that includes the vmwgfx DRM component. Because the kernel identifies itself as Linux:Linux in the CNAs list, affected systems encompass all distributions that ship the default kernel with vmwgfx enabled. No specific version range is supplied, so the crash risk applies to any build prior to the fix applied in the referenced commits.

The CVSS score of 7.8 indicates a high severity of the vulnerability. The EPSS score of <1% suggests that exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need to trigger the erroneous paths, typically through privileged access or local exploitation of the driver, in order to cause kernel memory corruption that could lead to a denial of service or potential compromise of system integrity, depending on the environment and the presence of other mitigations.