CVE-2026-80702

A flaw was found in the Linux kernel's drm/vmwgfx component. Incorrect assignments of boolean values to the guest_memory_size field instead of the guest_memory_dirty bitfield can lead to the field holding an incorrect size. This can cause subsequent operations to read or write past the intended memory boundaries, potentially resulting in memory corruption.

A wrong field assignment in vmwgfx can overwrite guest_memory_size with boolean values instead of updating guest_memory_dirty. Later revalidation paths may use the corrupted size while calculating dirty page ranges and buffer allocation sizes, which can cause zero length walks or wrap around ranges and lead to out-of-bounds read/write past the MOB bitmap. For the CVSS the PR:L is used because a local user in the guest may be able to reach vmwgfx through DRM device ioctls or render nodes depending on system policy. The issue is not directly network reachable. Impact is at least local denial of service via kernel crash and in the paranoid case may include confidentiality or integrity impact due to kernel memory corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.