CVE-2026-80700

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

drm/vmwgfx: validate external BO copy bounds for both stride paths

vmw_external_bo_copy() trusts caller-supplied offsets, strides, and

heights and operates on imported dma-buf vmaps:

- The equal-stride memcpy() bound was clamped after subtracting the

offsets from dst_size and src_size; an offset larger than the BO

size wraps the unsigned subtraction to a huge value and the

resulting memcpy() runs off the end of the vmap. dst_stride *

height is also a u32 multiplication that can overflow.

- The non-equal-stride row-by-row path had no bound at all. The

loop touches bytes through offset + (height - 1) * stride +

width_in_bytes, with only a WARN_ON(dst_stride < width_in_bytes),

and could likewise step past the end of either mapping.

The offsets and strides are derived from STDU/SOU plane state, so a

configured CRTC submitting a crafted atomic commit on an imported

framebuffer can reach

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References