UBUNTU-CVE-2026-80702: High severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: fix guestmemorydirty bitfield clobbered as size Two sites in vmwgfxresource.c assign boolean literals to res->guestmemorysize, which is an unsigned long allocation-size field; the intended target is the adjacent res->guestmemorydirty bitfield. After the assignments the field holds 0 or 1 instead of the resource's MOB allocation size: - vmwresourcerelease() writes 0 (false), and - vmwresourceunbindlist() writes 1 (true). Subsequent revalidation paths read guestmemorysize when computing the dirty page range (vmwbodirtytransfertores()) and the buffer allocation size (vmwresourcebufalloc()), producing zero-length walks or wrap-around ranges that read or write past the MOB bitmap. The dirty-tracking intent of the original code (mark the resource as dirtied since the last sync) is also lost, since guestmemorydirty is never updated. Rename both assignments to guestmemorydirty.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In vmwgfx_resource.c, change both assignments in vmw_resource_release() and vmw_resource_unbind_list() from res->guest_memory_size to res->guest_memory_dirty, preserving the boolean dirty-state updates and preventing corruption of the MOB allocation-size field.