The Linux kernel’s drm/vmwgfx driver fails to validate the pitch value supplied by userspace before copying data from the underlying surface. This omission permits a local process to provide an invalid pitch that causes the driver to read beyond the buffer bounds, potentially revealing kernel memory contents. The outcome is a confidentiality breach, allowing cursor snooping and exfiltration of private kernel data without requiring elevated privileges.

All Linux kernel releases that include the unpatched drm/vmwgfx implementation are affected. The flaw existed until a commit added pitch validation; any kernel compiled before that commit remains vulnerable. Because it resides in the DRM subsystem, the vulnerability applies to all distributions and vendor kernels that ship the vmwgfx driver.

The flaw is local; a user or local process with access to the vmwgfx ioctl interface can supply an out-of-bounds pitch value to trigger the read. The CVSS score of 7.8 indicates high severity, yet the EPSS score of <1% demonstrates a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves a malicious or compromised userspace application issuing ioctl calls against the vmwgfx driver.