CVE-2026-80887: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-80887 Overview

CVE-2026-80887 is an integer overflow vulnerability in the Linux kernel's VMware graphics driver (drm/vmwgfx). The flaw resides in the vmw_shader_define() function, which validates a user-supplied shader window against its backing buffer. The size and offset addition wraps around when drm_vmw_shader_create_arg::offset approaches U64_MAX, allowing the bounds check to pass with an out-of-range value. The unbounded offset is then stored in res->guest_memory_offset and forwarded to host SVGA shader-create commands, breaking memory-safety guarantees enforced by the driver.

Critical Impact
A local user with access to the vmwgfx DRM device can bypass buffer bounds validation and pass an arbitrary guest memory offset to host SVGA shader commands.

Affected Products

Linux kernel drm/vmwgfx driver (VMware virtual GPU)
Linux guest virtual machines running under VMware hypervisors with the vmwgfx DRM driver enabled
Stable kernel branches referenced by the fix commits 1bbe7751, 54d56d5b, 5c725901, cfd16316, and d3f44438

Discovery Timeline

2026-09-04 - CVE-2026-80887 published to NVD
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80887

Vulnerability Analysis

The vmw_shader_define() function in the vmwgfx DRM driver accepts a user-controlled shader definition through the drm_vmw_shader_create_arg UAPI structure. Before binding the shader to its backing buffer object, the driver checks that the requested window fits within the buffer using an addition of size and offset cast to u64. Because both operands are already 64-bit, the sum can wrap past U64_MAX and produce a small value that trivially satisfies the comparison against buffer->tbo.base.size.

Once the bounds check succeeds, the untrusted offset is written to res->guest_memory_offset and forwarded to the host SVGA device as part of shader-create commands. This allows the guest to reference memory outside the shader's backing buffer, undermining the isolation the driver is supposed to enforce between shader resources and the surrounding kernel or DMA memory.

Root Cause

The root cause is unchecked arithmetic in a security-critical bounds validation. The uapi field drm_vmw_shader_create_arg::offset is declared __u64, so casting it and adding another u64 provides no additional headroom. The fix replaces the arithmetic with check_add_overflow(), which detects wraparound explicitly and compares the true endpoint against the buffer size. This falls under integer overflow leading to improper input validation.

Attack Vector

Exploitation requires local access to the vmwgfx DRM device node, typically /dev/dri/cardN, which is generally accessible to users in the video or render group inside a VMware guest. An attacker crafts an ioctl invocation for shader creation with an offset near U64_MAX and a size chosen so the sum wraps below the buffer size. Because the check passes, the driver programs the host SVGA device with the attacker-controlled offset, potentially enabling out-of-bounds memory access or information disclosure through the shader resource pipeline.

No public proof-of-concept has been published. Technical details of the fix are available in the upstream kernel commits, including Kernel Git Commit 1bbe7751 and Kernel Git Commit d3f44438.

Detection Methods for CVE-2026-80887

Indicators of Compromise

Unexpected ioctl calls to /dev/dri/card* invoking DRM_IOCTL_VMW_CREATE_SHADER with unusually large offset values approaching U64_MAX.
Kernel log entries from vmwgfx reporting shader creation failures, SVGA command errors, or guest memory faults following shader operations.
Unprivileged processes inside a VMware guest interacting with the DRM subsystem outside expected graphics workloads.

Detection Strategies

Audit ioctl system calls targeting DRM device nodes and flag arguments with 64-bit offset fields set to boundary values.
Correlate dmesg output from the vmwgfx and drm subsystems with process execution telemetry to identify anomalous shader-create sequences.
Deploy kernel version inventory checks across Linux VMware guests to identify hosts running vulnerable versions predating the fix commits.

Monitoring Recommendations

Ingest kernel audit logs and DRM subsystem messages into a centralized logging or SIEM platform for retention and correlation.
Monitor for privilege escalation attempts or unexpected kernel crashes on Linux VMs hosted on VMware infrastructure.
Track patch compliance for stable Linux kernel branches to confirm the vmwgfx fix has been applied across the fleet.

How to Mitigate CVE-2026-80887

Immediate Actions Required

Update affected Linux guests to a kernel version containing the vmwgfx check_add_overflow fix referenced by the upstream commits.
Restrict access to /dev/dri/card* device nodes to trusted users only, removing membership from the video and render groups where graphics acceleration is not required.
Inventory VMware-hosted Linux systems that load the vmwgfx kernel module and prioritize them for patching.

Patch Information

The fix replaces the unchecked (u64)size + (u64)offset arithmetic with check_add_overflow() and compares the computed endpoint against buffer->tbo.base.size. Patches were merged across stable branches in commits 1bbe7751, 54d56d5b, 5c725901, cfd16316, and d3f44438. Apply the corresponding stable kernel update from your distribution vendor.

Workarounds

Unload the vmwgfx kernel module on Linux guests that do not require 3D acceleration, using modprobe -r vmwgfx and blacklisting the module on boot.
Disable 3D acceleration in the VMware virtual machine settings to reduce reliance on the vulnerable shader path.
Enforce strict filesystem permissions on /dev/dri/* nodes so only vetted service accounts can issue DRM ioctl calls.

bash

# Blacklist the vmwgfx module until the patched kernel is deployed
echo 'blacklist vmwgfx' | sudo tee /etc/modprobe.d/blacklist-vmwgfx.conf
sudo modprobe -r vmwgfx
sudo update-initramfs -u