UBUNTU-CVE-2026-80701: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: enforce cursor size limits for MOB cursors vmwcursorplaneatomiccheck() bounds cursor width and height only on the legacy update path; the SVGACAP2CURSORMOB path -- the default on modern hosts -- accepts any size. When the requested size exceeds SVGAREGCURSORMAXDIMENSION or SVGAREGMOBMAXSIZE, vmwcursormobget() returns -EINVAL and leaves vps->cursor.mob NULL. Its return value is then discarded in vmwcursorplanepreparefb(), so the subsequent vmwcursorupdatemob() calls vmwbomapandcache(NULL) and oopses inside vmwbomapandcachesize() on the tbo.base.size load. Reachable from any DRM master via DRMIOCTLMODECURSOR2 with a sufficiently large width or height (e.g. cursormaxdim + 1). Reject oversized cursors in atomiccheck for both MOB-backed cursor update types. The MOB byte-size limit only applies to the SVGACAP2CURSORMOB path (vmwcursormobsize() returns 0 for GBONLY); compute the required MOB size in 64-bit to avoid overflow when very large dimensions are requested. In preparefb only call vmwcursormobget()/map() for VMWCURSORUPDATEMOB -- the GBONLY path uses bo->map.virtual directly and would otherwise be silently downgraded to NONE on hosts without SVGACAP2CURSORMOB (where vmwcursormobget() always returns -EINVAL). Degrade the update to NONE if vmwcursormobget() or vmwcursormobmap() fails so the update path does not run with a NULL backing MOB.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In vmw_cursor_plane_atomic_check(), reject oversized cursors for both MOB-backed cursor update types when the requested width or height exceeds SVGA_REG_CURSOR_MAX_DIMENSION or SVGA_REG_MOB_MAX_SIZE; compute the required MOB size in 64-bit to prevent overflow.
- Compensating control
In vmw_cursor_plane_prepare_fb(), call vmw_cursor_mob_get() and vmw_cursor_mob_map() only for VMW_CURSOR_UPDATE_MOB, use bo->map.virtual directly for the GB_ONLY path, and degrade the update to NONE if either MOB operation fails so the update path cannot run with a NULL backing MOB.