CVE-2026-80888: drm/vmwgfx: drop dma_buf reference on foreign-fd prime import
In the Linux kernel, the following vulnerability has been resolved:
drm/vmwgfx: drop dmabuf reference on foreign-fd prime import
ttmprimefdtohandle() returns -ENOSYS when the imported fd's dmabuf->ops do not match the ttmobjectdevice's ops, but does so without releasing the reference acquired by dmabufget(). Any unprivileged renderD client passing a non-vmwgfx prime fd through the DRMVMWGBSURFACEREF{,EXT} path leaks one dmabuf reference per call and indefinitely pins the foreign exporter's GEM resources.
Funnel the error path through the existing dmabufput() so the reference is always dropped.
Affected Software
Event History
Frequently Asked Questions
Who can trigger the resource leak?
An unprivileged client with access to a vmwgfx render node can trigger it through the DRM_VMW_GB_SURFACE_REF or DRM_VMW_GB_SURFACE_REF_EXT path by supplying a non-vmwgfx PRIME file descriptor.
What resources are affected by repeated exploitation?
Each triggering call leaks one dma_buf reference. This indefinitely pins the foreign exporter’s GEM resources, so repeated calls can accumulate retained resources.
What condition causes the vulnerable error path?
The issue occurs when the imported file descriptor’s dma_buf operations do not match the vmwgfx TTM object device operations. In that case, ttm_prime_fd_to_handle() returns -ENOSYS without dropping the reference acquired by dma_buf_get().
What does the fix change?
The fix routes the error path through dma_buf_put(), ensuring that the dma_buf reference is released when the PRIME import is rejected.