CVE-2026-23008: drm/vmwgfx: Fix KMS with 3D on HW version 10
In the Linux kernel, the following vulnerability has been resolved:
drm/vmwgfx: Fix KMS with 3D on HW version 10
HW version 10 does not have GB Surfaces so there is no backing buffer for surface backed FBs. This would result in a nullptr dereference and crash the driver causing a black screen.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.7 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.18.8-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23008?
CVE-2026-23008 is classified as a moderate severity vulnerability.
How do I fix CVE-2026-23008?
To fix CVE-2026-23008, you need to update the Linux kernel to the patched version that resolves the KMS issue with HW version 10.
What impact does CVE-2026-23008 have on my system?
CVE-2026-23008 can cause a nullptr dereference, potentially leading to system instability or crashes when using 3D features.
Which versions of the Linux kernel are affected by CVE-2026-23008?
CVE-2026-23008 affects certain versions of the Linux kernel that include the drm/vmwgfx component for HW version 10.
Is CVE-2026-23008 a remote exploit?
CVE-2026-23008 is not a remote exploit and requires local execution to exploit the vulnerability.