CVE-2026-80887: drm/vmwgfx: use check_add_overflow for shader size+offset bound
In the Linux kernel, the following vulnerability has been resolved:
drm/vmwgfx: use checkaddoverflow for shader size+offset bound
vmwshaderdefine() validates the user-supplied shader window against its backing buffer with
(u64)buffer->tbo.base.size < (u64)size + (u64)offset
drmvmwshadercreatearg::offset is u64 in the uapi; when it is near U64MAX the unsigned addition wraps and the resulting tiny value passes the check. The unbounded offset is then stored in res->guestmemoryoffset and forwarded to host SVGA shader-create commands.
Use checkaddoverflow() to detect the wrap and compare the resulting endpoint against the buffer size.
Affected Software
Event History
Frequently Asked Questions
What input is required to trigger the faulty bounds check?
The shader offset must be user-controlled and near U64_MAX so that adding the supplied shader size causes an unsigned 64-bit wraparound. The wrapped, small result can then incorrectly pass the backing-buffer bounds check.
Which systems are relevant to triage?
The issue is relevant where the Linux kernel vmwgfx driver processes user-supplied shader definitions backed by a buffer. The affected path stores the unchecked offset and forwards it in host SVGA shader-create commands.
What does the available fix change?
The fix replaces the vulnerable size-plus-offset calculation with check_add_overflow(). It rejects overflow before comparing the computed endpoint with the backing buffer size.