CVE-2026-80888

A flaw was found in the drm/vmwgfx component of the Linux kernel. An unprivileged client can exploit this vulnerability by passing a specially crafted file descriptor (fd) to the DRM_VMW_GB_SURFACE_REF or DRM_VMW_GB_SURFACE_REF_EXT paths. This can lead to a dma_buf reference leak, causing resource exhaustion and potentially a denial of service (DoS) by indefinitely pinning Graphics Execution Manager (GEM) resources.

This vulnerability is rated as Low severity because exploitation requires local access and is restricted to VMware guest environments utilizing the vmwgfx graphics driver. In standard enterprise deployments, bare-metal hardware and non-VMware virtualized hosts do not load this driver and remain unaffected. While a local unprivileged user interacting with the direct rendering node can induce memory resource starvation by leaking shared buffer references, the issue cannot lead to privilege escalation or breach data confidentiality.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.