« Volver al listado

CVE-2026-80887

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

drm/vmwgfx: use check_add_overflow for shader size+offset bound

vmw_shader_define() validates the user-supplied shader window against its backing buffer with

drm_vmw_shader_create_arg::offset is __u64 in the uapi; when it is near U64_MAX the unsigned addition wraps and the resulting tiny value passes the check. The unbounded offset is then stored in res->guest_memory_offset and forwarded to host SVGA shader-create commands.

Use check_add_overflow() to detect the wrap and compare the resulting endpoint against the buffer size.

Detalles técnicos trazas, registros y código del informe original
	(u64)buffer->tbo.base.size < (u64)size + (u64)offset

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-80887",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "668b206601c5f5063e03b76784a0d3024fa2b249",
              "lessThan": "1bbe7751f5ebac383405ef29a66622d65bd505d3",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "668b206601c5f5063e03b76784a0d3024fa2b249",
              "lessThan": "d3f44438aa805270aaead3b6840ccaea0f4c11f9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "668b206601c5f5063e03b76784a0d3024fa2b249",
              "lessThan": "cfd163169af3be56eaef113c680ea251f0d09189",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "668b206601c5f5063e03b76784a0d3024fa2b249",
              "lessThan": "5c725901908eb1e52a16fc0e2373cb761df42d21",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "668b206601c5f5063e03b76784a0d3024fa2b249",
              "lessThan": "54d56d5b42d2e4c72ba6e365e9774da90698aa22",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/gpu/drm/vmwgfx/vmwgfx_shader.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "6.4",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver",
              "lessThanOrEqual": "7.1.*"
            },
            {
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/gpu/drm/vmwgfx/vmwgfx_shader.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-04T18:17:56.667",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/1bbe7751f5ebac383405ef29a66622d65bd505d3",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/54d56d5b42d2e4c72ba6e365e9774da90698aa22",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/5c725901908eb1e52a16fc0e2373cb761df42d21",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/cfd163169af3be56eaef113c680ea251f0d09189",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d3f44438aa805270aaead3b6840ccaea0f4c11f9",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: use check_add_overflow for shader size+offset bound\n\nvmw_shader_define() validates the user-supplied shader window against\nits backing buffer with\n\n\t(u64)buffer->tbo.base.size < (u64)size + (u64)offset\n\ndrm_vmw_shader_create_arg::offset is __u64 in the uapi; when it is\nnear U64_MAX the unsigned addition wraps and the resulting tiny value\npasses the check.  The unbounded offset is then stored in\nres->guest_memory_offset and forwarded to host SVGA shader-create\ncommands.\n\nUse check_add_overflow() to detect the wrap and compare the resulting\nendpoint against the buffer size."
    }
  ],
  "lastModified": "2026-09-04T18:17:56.667",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}