CVE-2026-80887

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/vmwgfx: use check_add_overflow for shader size+offset bound

vmw_shader_define() validates the user-supplied shader window against

its backing buffer with

(u64)buffer->tbo.base.size < (u64)size + (u64)offset

drm_vmw_shader_create_arg::offset is __u64 in the uapi; when it is

near U64_MAX the unsigned addition wraps and the resulting tiny value

passes the check. The unbounded offset is then stored in

res->guest_memory_offset and forwarded to host SVGA shader-create

commands.

Use check_add_overflow() to detect the wrap and compare the resulting

endpoint against the buffer size.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References