HIGH Introduced in 5.7
vmwgfx SurfaceArray OOB
CVE-2026-68446
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Validate vmw_surface_metadata::array_size This field comes from userspace and should be validated against specific limits depending on which Shader Model (SM) is available.
02KernelScan AI Analysis
Risk summary
A local user with access to the VMware graphics DRM device can supply an unchecked array size when creating GPU surfaces, potentially causing heap memory corruption. This can lead to kernel-level code execution, information disclosure, or denial of service. The vulnerability requires only local device access available to unprivileged users on systems running the vmwgfx driver.
Vulnerability analysis
When a userspace process creates a GPU surface through the VMware graphics driver, the array size field from the request is not properly validated against hardware limits. The original code only blocked non-zero values on older hardware but allowed arbitrarily large values on newer hardware with SM4 or SM5 support. This unchecked value feeds into memory allocation calculations, where it can cause integer overflow leading to undersized heap allocations and subsequent out-of-bounds writes when the surface is later used. The fix adds explicit maximum limits for each supported Shader Model, rejecting oversized array dimensions before they reach memory allocation. The vulnerable path is reachable from any local user who can open the VMware graphics device node, which is typically available to unprivileged users on systems running as VMware virtual machines.
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 5.7 | 6.12.101 | 71779fe8bf40 |
| 6.18 | 5.7 | 6.18.42 | b1379f0c42b8 |
| 6.6 | 5.7 | 6.6.148 | 5ff94e127917 |
| 7.1 | 5.7 | 7.1.6 | 6910ccaf4167 |
| mainline | 5.7 | 7.2-rc5 | a4f55260f7f7 |