CVE-2026-80701: Linux Kernel DRM VMWgfx Privilege Escalation

CVE-2026-80701 Overview

CVE-2026-80701 is a NULL pointer dereference vulnerability in the Linux kernel's drm/vmwgfx driver. The flaw resides in the cursor plane handling logic used by the VMware SVGA graphics driver. vmw_cursor_plane_atomic_check() enforces cursor width and height limits only on the legacy update path. The SVGA_CAP2_CURSOR_MOB path, which is the default on modern hosts, accepts any size. A local user with DRM master access can trigger a kernel oops through DRM_IOCTL_MODE_CURSOR2 by supplying cursor dimensions that exceed SVGA_REG_CURSOR_MAX_DIMENSION or SVGA_REG_MOB_MAX_SIZE.

Critical Impact
Local denial of service through a kernel NULL pointer dereference reachable from any DRM master via the cursor ioctl on affected Linux guests running under VMware.

Affected Products

Linux kernel drm/vmwgfx driver on hosts exposing SVGA_CAP2_CURSOR_MOB
Linux guests running under VMware hypervisors using the vmwgfx graphics stack
Stable kernel branches prior to the fixes referenced in the upstream commits

Discovery Timeline

2026-08-28 - CVE-2026-80701 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-80701

Vulnerability Analysis

The vmw_cursor_plane_atomic_check() function validates cursor dimensions only for the legacy update path. When the driver operates under SVGA_CAP2_CURSOR_MOB, oversized cursors bypass the dimension check. vmw_cursor_mob_get() then rejects the allocation with -EINVAL because the requested size exceeds SVGA_REG_CURSOR_MAX_DIMENSION or SVGA_REG_MOB_MAX_SIZE, leaving vps->cursor.mob set to NULL.

The return value from vmw_cursor_mob_get() is discarded inside vmw_cursor_plane_prepare_fb(). The subsequent call chain reaches vmw_cursor_update_mob(), which invokes vmw_bo_map_and_cache(NULL). The dereference occurs inside vmw_bo_map_and_cache_size() when loading tbo.base.size from the NULL buffer object.

Root Cause

The root cause is missing input validation on the MOB-backed cursor update path combined with an ignored error return. The atomic check enforces bounds only for the legacy path, and the prepare_fb stage does not propagate allocation failures. An additional 32-bit multiplication in the MOB size computation can overflow when very large dimensions are supplied.

Attack Vector

Any process holding DRM master privileges can invoke DRM_IOCTL_MODE_CURSOR2 with a width or height greater than cursor_max_dim + 1. The kernel then dereferences a NULL pointer inside the vmwgfx code path, producing a kernel oops. The result is a local denial of service against the affected guest kernel.

No verified public exploit code is available. See the upstream commits for the technical fix details: 1eb4f79, 9109b79, and d5ed874.

Detection Methods for CVE-2026-80701

Indicators of Compromise

Kernel oops entries in dmesg or /var/log/kern.log referencing vmw_bo_map_and_cache_size or vmw_cursor_update_mob
Unexpected DRM master processes issuing DRM_IOCTL_MODE_CURSOR2 calls with abnormally large width or height parameters
Repeated graphics subsystem crashes on VMware-hosted Linux guests running vmwgfx

Detection Strategies

Monitor kernel ring buffer output for NULL pointer dereference stack traces originating in the drm/vmwgfx module
Audit processes with DRM master capability and correlate ioctl activity with cursor plane operations
Track kernel crash telemetry across VMware-hosted Linux fleets to identify clustered vmwgfx failures

Monitoring Recommendations

Ingest dmesg, journald, and /var/log/kern.log into a central log platform and alert on vmwgfx oops signatures
Baseline normal cursor ioctl activity and flag processes issuing atypical dimensions to the DRM subsystem
Track kernel package versions across VMware guest inventories to identify hosts pending the upstream fix

How to Mitigate CVE-2026-80701

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the stable tree commits 1eb4f79, 9109b79, and d5ed874
Update to a distribution kernel that includes the vmwgfx cursor size enforcement fix
Restrict DRM master access to trusted users on multi-tenant Linux guests running under VMware

Patch Information

The fix rejects oversized cursors in atomic_check for both MOB-backed cursor update types, computes the required MOB size in 64-bit to avoid overflow, and only calls vmw_cursor_mob_get() and vmw_cursor_mob_map() for VMW_CURSOR_UPDATE_MOB. The update path degrades to NONE when the MOB allocation or mapping fails, preventing execution with a NULL backing MOB. Patches are available in the stable kernel tree at commits 1eb4f79, 9109b79, and d5ed874.

Workarounds

Limit interactive graphical sessions and DRM master privileges to trusted local accounts until patches are applied
Consider switching Linux guests to an alternative graphics driver where feasible until the vmwgfx fix is deployed
Enable kernel crash reporting so vmwgfx oops events are captured and triaged rapidly