CVE-2026-80700

A flaw was found in the drm/vmwgfx component of the Linux kernel. This vulnerability allows a local attacker to cause memory corruption by providing specially crafted input to the vmw_external_bo_copy() function. The function, which handles copying data between graphics buffers, does not properly validate the boundaries of these operations, leading to an out-of-bounds memory write or read. This could result in system instability or a denial of service.

A bounds validation flaw in vmwgfx external BO copy can allow an out-of-bounds read or write when copying imported dma-buf backed framebuffers. The vulnerable path trusts caller controlled offsets, strides, and height from plane state, and a crafted atomic commit on a configured CRTC can make memcpy operate past the end of the source or destination vmap. For the CVSS the PR:L is used because reliable triggering requires local access to the DRM/vmwgfx graphics interface or an equivalent local graphics session, but not full administrator privileges. The issue is not network reachable. Impact is at least local denial of service via kernel crash and in the worst case may allow confidentiality and integrity impact or privilege escalation because the bug includes an out-of-bounds write primitive in kernel mapped memory.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.