CVE-2026-99002: drm/vmwgfx: validate pitch coming from userspace
Published Oct 23, 2026
·Updated
In the Linux kernel, the following vulnerability has been resolved:
drm/vmwgfx: validate pitch coming from userspace
Validate the pitch, alongside the box dimensions before trying to copy data from the underlying surface. Fixes possible out of bounds reads with cursor snooping.
Affected Software
1 affected component
Linux Linux kernel
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In drm/vmwgfx, validate the pitch supplied by userspace alongside the box dimensions before copying data from the underlying surface, preventing out-of-bounds reads from cursor snooping.
Event History
Oct 23, 2026
CVE Published
via MITRE·12:20 PM
Data Sourced
via MITRE·12:20 PM
Description