CVE-2026-80701

A flaw was found in the Linux kernel's drm/vmwgfx component. A local attacker with DRM master privileges could exploit this by providing oversized cursor dimensions through the DRM_IOCTL_MODE_CURSOR2 interface. This improper input validation can lead to a kernel crash, resulting in a Denial of Service (DoS) for the affected system.

A moderate-severity denial of service flaw was found in the Linux kernel's drm/vmwgfx driver. The SVGA_CAP2_CURSOR_MOB cursor update path, which is the default on modern VMware hosts, does not validate cursor width and height against the SVGA_REG_CURSOR_MAX_DIMENSION or SVGA_REG_MOB_MAX_SIZE limits. A local attacker with DRM master privileges, such as a process controlling a graphical session, could request an oversized cursor through the DRM_IOCTL_MODE_CURSOR2 ioctl. This causes vmw_cursor_mob_get() to fail and leave the cursor MOB NULL; because that error return is discarded, the subsequent update path calls vmw_bo_map_and_cache() on the NULL pointer, resulting in a kernel oops and a system crash. Only availability is impacted; there is no effect on confidentiality or integrity. Red Hat rated this flaw Moderate (CVSS 3.1: 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), reflecting a local, low-privilege denial of service.

This flaw affects Red Hat Enterprise Linux 9 (kernel and kernel-rt in the rhel-9.8.z, rhel-9.9, and rhel-9.10 streams), Red Hat Enterprise Linux 10 (kernel in the rhel-10.2.z, rhel-10.3, and rhel-10.4 streams), and Red Hat In-Vehicle OS 2 (kernel and kernel-ivos-qualcomm), where the vulnerable code was introduced through merges of upstream DRM changes from v6.16. Earlier releases and streams (RHEL 6, 7, and 8, and the rhel-9.2.0.z, rhel-9.4.z, rhel-9.6.z, and rhel-10.0.z streams) are not affected because the vulnerable code is not present. Because the impact is limited to a local kernel crash on systems using the vmwgfx driver on VMware hosts, fixes for the affected streams are currently deferred to a future update; the residual risk remains a local denial of service with no confidentiality or integrity impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.