CVE-2026-80887

A flaw was found in the drm/vmwgfx component of the Linux kernel. An integer overflow vulnerability exists in the vmw_shader_define() function due to improper validation of user-supplied shader window size and offset. When the offset value is close to its maximum, an unsigned addition can wrap around, causing the size check to pass incorrectly. This allows an unbounded offset to be used, which could lead to memory corruption and potentially privilege escalation or denial of service.

A flaw was found in the Linux kernel drm/vmwgfx driver, which Red Hat Product Security rates as IMPORTANT (CVSS 7.0, CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The vmw_shader_define() function validates a user-supplied shader window against its backing buffer using an unsigned addition of size and offset. Because drm_vmw_shader_create_arg::offset is a 64-bit user-controlled value, an offset near U64_MAX causes the addition to wrap around, so the resulting small value incorrectly passes the bounds check. The unbounded offset is then stored in res->guest_memory_offset and forwarded to the host SVGA shader-create commands. A local unprivileged attacker with access to the vmwgfx DRM device, such as within a guest virtual machine using VMware graphics, could exploit this integer overflow to cause memory corruption, potentially leading to privilege escalation or denial of service; successful exploitation is judged to require high attack complexity. Currently affected products include the Red Hat Enterprise Linux 8, 9, and 10 kernels (kernel and kernel-rt) and Red Hat In-Vehicle OS, for which fixes are being pursued. Several older update streams (RHEL 7 ELS, RHEL 8.4, 8.6, and 8.8 z streams, and RHEL 9.2.0.z) are not affected because the vulnerable code is not present in those kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, prevent the vmwgfx kernel module from loading if VMware virtual graphics acceleration is not needed:

1. Create a configuration file to prevent the module from being loaded:

echo "install vmwgfx /bin/true" > /etc/modprobe.d/disable-vmwgfx.conf

2. If the module is currently loaded, reboot the system for the change to take effect:

reboot

Warning: Disabling this module prevents VMware guest graphics acceleration and may impair graphical desktop environments running inside VMware virtual machines. A reboot is necessary if the driver is already active in memory.