CVE-2026-80702: Linux Kernel Use-After-Free Vulnerability

CVE-2026-80702 Overview

CVE-2026-80702 is a Linux kernel vulnerability in the VMware graphics driver (drm/vmwgfx). Two sites in vmwgfx_resource.c assign boolean literals to res->guest_memory_size, an unsigned long allocation-size field, when the intended target is the adjacent res->guest_memory_dirty bitfield. The mismatch causes vmw_resource_release() to write 0 and vmw_resource_unbind_list() to write 1 into the size field. Subsequent revalidation paths read guest_memory_size when computing dirty page ranges and buffer allocation sizes, producing zero-length walks or wrap-around ranges that read or write past the MOB bitmap. The dirty-tracking intent is also lost because guest_memory_dirty is never updated.

Critical Impact
A local, low-privileged attacker in a VMware guest can trigger out-of-bounds memory access in the kernel, leading to memory corruption, information disclosure, or denial of service.

Affected Products

Linux kernel drm/vmwgfx driver (VMware graphics driver)
Linux guest systems running on VMware hypervisors with the vmwgfx driver enabled
Multiple stable kernel branches receiving backported fixes

Discovery Timeline

2026-08-28 - CVE-2026-80702 published to NVD
2026-08-29 - Last updated in NVD database

Technical Details for CVE-2026-80702

Vulnerability Analysis

The vulnerability resides in the Direct Rendering Manager (DRM) subsystem for VMware graphics (drm/vmwgfx). Two assignments in vmwgfx_resource.c write boolean values into the wrong structure member. Specifically, vmw_resource_release() writes false (0) and vmw_resource_unbind_list() writes true (1) into res->guest_memory_size instead of the adjacent res->guest_memory_dirty bitfield.

The guest_memory_size field stores the allocation size of the Memory Object Block (MOB) backing store for graphics resources. When corrupted, downstream code paths use this value for buffer size calculations and dirty-page range computations. The result is either zero-length operations or arithmetic wrap-around producing out-of-bounds accesses against the MOB bitmap.

Root Cause

The root cause is a typographical or refactoring error where the size field name replaced the intended bitfield name. Because guest_memory_dirty is a bitfield adjacent to guest_memory_size in the struct vmw_resource layout, the compiler accepted the assignment without warning. The intent to track resource dirtying between synchronization cycles was lost while the allocation-size field was silently clobbered.

Attack Vector

Exploitation requires local access with low privileges inside a Linux guest running on VMware where the vmwgfx driver is loaded. An unprivileged user can invoke DRM ioctls that trigger vmw_resource_release() or vmw_resource_unbind_list() code paths. Subsequent revalidation via vmw_bo_dirty_transfer_to_res() or vmw_resource_buf_alloc() then operates on the corrupted size, walking memory past the MOB bitmap. The out-of-bounds read/write can be leveraged for kernel memory corruption, information disclosure, or denial of service.

No verified public proof-of-concept code is available. See the upstream kernel patch for the exact source change.

Detection Methods for CVE-2026-80702

Indicators of Compromise

Unexpected kernel oops or panic messages referencing vmwgfx, vmw_resource_release, vmw_resource_unbind_list, vmw_bo_dirty_transfer_to_res, or vmw_resource_buf_alloc.
KASAN or KFENCE reports indicating out-of-bounds access in the vmwgfx MOB bitmap region on VMware guests.
Graphics subsystem instability, DRM client crashes, or Xorg/Wayland session terminations correlated with heavy graphics resource churn.

Detection Strategies

Enable KASAN on test kernels to surface out-of-bounds reads and writes triggered by DRM ioctls in the vmwgfx driver.
Audit running Linux VMware guests to confirm kernel version and whether the fix commits (21bbe38faee4, 282f261cb035, 3b2bb16a5b62, 83195b778f2d, 9d6cbb76fe9c) are present.
Correlate kernel ring buffer messages (dmesg) against known-vulnerable stack traces involving vmwgfx resource release paths.

Monitoring Recommendations

Forward /var/log/kern.log and journalctl -k output to a centralized log platform and alert on vmwgfx oops signatures.
Track kernel package versions across the fleet and flag VMware guests still running pre-patch kernels.
Monitor DRM ioctl volumes from unprivileged users on multi-tenant guests where local privilege escalation would be impactful.

How to Mitigate CVE-2026-80702

Immediate Actions Required

Update affected Linux guests to a kernel version that includes one of the upstream fix commits listed in the patch information section.
Prioritize patching multi-user Linux VMware guests where local unprivileged accounts exist.
Where patching is delayed, restrict access to DRM device nodes (/dev/dri/*) to trusted users only.

Patch Information

The upstream fix renames both erroneous assignments from guest_memory_size to guest_memory_dirty, restoring correct dirty-tracking and preserving the MOB allocation size. Fix commits are available across multiple stable branches: 21bbe38faee4, 282f261cb035, 3b2bb16a5b62, 83195b778f2d, and 9d6cbb76fe9c. Apply the distribution kernel update that incorporates the appropriate commit for your kernel series.

Workarounds

Restrict permissions on /dev/dri/* DRM device nodes so only trusted users and services can open them.
Where graphics acceleration is not required, blacklist the vmwgfx kernel module and use the vesafb or simpledrm fallback until patched kernels are deployed.
Limit local user access on VMware Linux guests and enforce least-privilege policies to reduce the pool of accounts that can invoke vulnerable code paths.

bash

# Blacklist the vmwgfx module until the patched kernel is deployed
echo 'blacklist vmwgfx' | sudo tee /etc/modprobe.d/blacklist-vmwgfx.conf
sudo update-initramfs -u
sudo reboot

# Verify the running kernel version after patching
uname -r