In the Linux kernel’s vmwgfx DRM driver, the vmw_shader_define() function validated a user‑supplied shader window by checking that the buffer’s size was less than the sum of a shader size and an offset. Because the offset was a 64‑bit unsigned value, adding it to the size could wrap around when it was near the maximum value of a 64‑bit integer. The wrap caused the resulting addition to appear small, allowing the check to succeed falsely. The unbounded offset was then stored as a guest memory offset and forwarded to the host’s SVGA shader‑create commands, giving the attacker a way to reference memory beyond the intended buffer. This can corrupt kernel data or trigger a kernel crash, providing a path to gain elevated privileges or cause denial of service.

Any Linux kernel version that includes the vmwgfx DRM driver and contains the flawed vmw_shader_define logic is potentially affected. No specific kernel releases were listed, so the issue applies to all kernels where this validation code is present.

The flaw requires interaction with the DRM interface, typically exposed via /dev/dri/cardX devices. If an attacker can create a DRM shader with an offset close to U64_MAX, the unsigned addition will wrap and pass the bounds check. The vulnerability is a classic integer overflow leading to out‑of‑bounds memory access with the potential for kernel privilege escalation. The EPSS score is not available and the CVE is not listed in CISA's KEV catalog, indicating no confirmed exploitation reports. Nonetheless, the severity is high given the kernel memory corruption vector and the potential impact on confidentiality, integrity, and availability.