CVE-2026-80700 Overview
CVE-2026-80700 is an out-of-bounds write vulnerability in the Linux kernel's VMware graphics driver (drm/vmwgfx). The flaw resides in the vmw_external_bo_copy() function, which trusts caller-supplied offsets, strides, and heights when operating on imported dma-buf vmaps. Attackers with local access to a configured CRTC can submit a crafted atomic commit on an imported framebuffer to reach the vulnerable code path. The resulting memcpy() can run past the end of the mapped buffer, corrupting kernel memory.
Critical Impact
A local attacker with low privileges can trigger kernel memory corruption, potentially leading to privilege escalation, denial of service, or full system compromise on Linux systems running the vmwgfx driver.
Affected Products
- Linux kernel versions containing the vulnerable drm/vmwgfx driver
- Systems using VMware virtual graphics acceleration (vmwgfx)
- Linux distributions shipping affected kernel builds prior to the referenced stable patches
Discovery Timeline
- 2026-08-28 - CVE-2026-80700 published to NVD
- 2026-08-29 - Last updated in NVD database
Technical Details for CVE-2026-80700
Vulnerability Analysis
The vulnerability exists in vmw_external_bo_copy() within the drm/vmwgfx kernel driver. The function performs copy operations between buffer objects (BOs) using caller-supplied offsets, strides, and heights derived from Screen Target Display Unit (STDU) and Screen Object Unit (SOU) plane state. Two distinct code paths are affected.
The equal-stride path clamps the memcpy() bound after subtracting offsets from dst_size and src_size. When a supplied offset exceeds the BO size, the unsigned subtraction wraps to a large value, and the resulting memcpy() writes past the end of the vmap. The multiplication dst_stride * height performed as a u32 operation can also overflow.
The non-equal-stride row-by-row path lacks bounds checking entirely. Its loop touches bytes through offset + (height - 1) * stride + width_in_bytes, guarded only by a WARN_ON(dst_stride < width_in_bytes). This allows writes to step past either mapping.
Root Cause
The root cause combines an integer underflow in unsigned arithmetic and missing bounds validation. Insufficient checking of arithmetic operations on user-influenced parameters permits the copy loop to exceed the allocated buffer, classifying this as both an integer overflow and an out-of-bounds write.
Attack Vector
Exploitation requires local access with the ability to submit atomic commits to a configured CRTC on an imported framebuffer. A local user crafts plane state containing malicious offsets, strides, or heights. When the kernel processes the atomic commit, vmw_external_bo_copy() performs the unsafe memory operations, producing an out-of-bounds write in kernel address space.
No verified public exploit code is available. See the Kernel.org patch commit 042ca38 for the technical fix details.
Detection Methods for CVE-2026-80700
Indicators of Compromise
- Unexpected kernel WARN_ON or oops messages referencing vmw_external_bo_copy or the vmwgfx driver in dmesg output
- Kernel panics or memory corruption events on systems running the VMware graphics driver
- Unusual atomic commit failures or DRM subsystem errors from unprivileged user sessions
Detection Strategies
- Monitor kernel logs for stack traces originating in drm/vmwgfx copy paths
- Audit installed kernel versions against the fixed commits published on kernel.org stable branches
- Correlate local user activity with graphics subsystem errors to identify potential exploitation attempts
Monitoring Recommendations
- Enable auditd rules to log processes interacting with /dev/dri/* device nodes
- Deploy endpoint telemetry to flag unexpected privilege escalation following graphics-related kernel events
- Track patch compliance across virtualized Linux fleets where vmwgfx is loaded
How to Mitigate CVE-2026-80700
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced by the fix commits and reboot affected systems
- Inventory Linux virtual machines running under VMware hypervisors and confirm the vmwgfx driver status
- Restrict local shell access on multi-user systems until patches are deployed
Patch Information
The fix validates the exact row-copy endpoint against each BO's size up front using check_mul_overflow() and check_add_overflow(). The bulk memcpy() path is used only when width_in_bytes covers the whole stride; otherwise a row-by-row copy preserves partial-row updates. The patch also rejects zero strides and any stride less than width_in_bytes. Reference the fix commits: 042ca38, 4e0f669, 5e4a2d1, 706c93c, and e7b25a6.
Workarounds
- Blacklist the vmwgfx module on systems that do not require VMware SVGA acceleration by adding blacklist vmwgfx to /etc/modprobe.d/
- Limit local user access and enforce least-privilege on multi-tenant Linux hosts to reduce local attack surface
- Where feasible, switch guest graphics to an alternate virtual display adapter until kernel patches are applied
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
