CVE-2026-80887: drm/vmwgfx: use check_add_overflow for shader size+offset bound
drm/vmwgfx: use checkaddoverflow for shader size+offset bound
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.152.1-1
Event History
Frequently Asked Questions
What input is required to trigger the faulty bounds check?
The shader offset must be user-controlled and near U64_MAX so that adding the supplied shader size causes an unsigned 64-bit wraparound. The wrapped, small result can then incorrectly pass the backing-buffer bounds check.
Which systems are relevant to triage?
The issue is relevant where the Linux kernel vmwgfx driver processes user-supplied shader definitions backed by a buffer. The affected path stores the unchecked offset and forwards it in host SVGA shader-create commands.
What does the available fix change?
The fix replaces the vulnerable size-plus-offset calculation with check_add_overflow(). It rejects overflow before comparing the computed endpoint with the backing buffer size.