In the Linux kernel, a bug in the vmwgfx driver causes boolean values to be written to an unsigned long field that holds resource allocation size, instead of setting the intended dirty‑status bitfield. The incorrect assignments leave the size field with the values 0 or 1, and subsequent logic that relies on this size for walking page ranges or allocating buffers uses the corrupted value. This can result in zero‑length walks or wrap‑around ranges that read or write past the intended memory bitmap, potentially corrupting kernel memory or causing a crash. The original intent to flag a resource as dirty is lost, thereby degrading the driver’s functionality.

The issue appears in any Linux kernel that includes the vmwgfx DRM component. Because the kernel identifies itself as Linux:Linux in the CNAs list, affected systems encompass all distributions that ship the default kernel with vmwgfx enabled. No specific version range is supplied, so the crash risk applies to any build prior to the fix applied in the referenced commits.

No CVSS score is provided, nor is the EPSS score available, and the vulnerability is not listed in the CISA KEV catalog. The bug resides in kernel space and requires the attacker to execute code with sufficient privilege to interact with the driver; a local threat is therefore likely. If an attacker can trigger the erroneous paths, they could achieve memory corruption within the kernel, which may lead to a denial of service or, in the right conditions, privilege escalation. The lack of a publicly documented CVSS score makes precise severity estimation difficult, but the nature of the bug suggests a high risk if the conditions for exploitation are met.