CVE-2026-80702: drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size
Published Aug 28, 2026
·Updated
drm/vmwgfx: fix guestmemorydirty bitfield clobbered as size
Affected Software
2 affected componentsFixes available
Linux Kernel
Microsoft azl3 kernel 6.6.150.1-1<6.6.152.1-1
6.6.152.1-1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.152.1-1
Event History
Aug 28, 2026
CVE Published
via MITRE·06:53 AM
Data Sourced
via MITRE·06:53 AM
DescriptionSeverity
Data Sourced
via NVD·08:16 AM
DescriptionSeverity
Aug 29, 2026
Data Sourced
via Microsoft·08:02 AM
DescriptionSeverityWeakness
Data Sourced
via Microsoft·08:02 AM
Affected Software
Updated
via Microsoft·08:02 AM
DescriptionSeverity
Frequently Asked Questions
1
Which resource lifecycle paths can lead to the corrupted allocation-size state?
The incorrect writes occur in vmw_resource_release(), which stores 0, and vmw_resource_unbind_list(), which stores 1, into guest_memory_size. Later resource revalidation can consume that corrupted value in vmw_bo_dirty_transfer_to_res() and vmw_resource_buf_alloc().
2
What failures can result once the resource is revalidated?
A zero or one value in the allocation-size field can cause zero-length dirty-page walks or wrap-around ranges. Those ranges can read or write beyond the MOB bitmap, while the intended dirty-state tracking is also not updated.