CVE-2026-80888: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-80888 Overview

CVE-2026-80888 is a resource management flaw in the Linux kernel's VMware graphics driver (drm/vmwgfx). The function ttm_prime_fd_to_handle() returns -ENOSYS when an imported file descriptor's dma_buf->ops do not match the ttm_object_device's operations, but it fails to release the reference acquired by dma_buf_get(). Any unprivileged renderD client passing a non-vmwgfx prime file descriptor through the DRM_VMW_GB_SURFACE_REF{,_EXT} ioctl path leaks one dma_buf reference per call. The leaked reference indefinitely pins the foreign exporter's GEM resources, enabling a local denial-of-service condition against kernel memory.

Critical Impact
An unprivileged local user with access to the DRM render node can exhaust kernel memory by repeatedly triggering the leak, pinning foreign GPU buffer resources indefinitely.

Affected Products

Linux kernel builds including the drm/vmwgfx driver prior to the fix commits
Systems running VMware virtual machines with the vmwgfx DRM driver enabled
Distributions shipping vulnerable stable kernel branches referenced in the upstream patches

Discovery Timeline

2026-09-04 - CVE-2026-80888 published to NVD
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80888

Vulnerability Analysis

The vulnerability resides in ttm_prime_fd_to_handle(), the helper used by the vmwgfx driver to convert a PRIME (DMA-BUF) file descriptor into a driver-local handle. The function first calls dma_buf_get() to acquire a reference on the incoming buffer, then inspects the buffer's operations vector. If the operations do not belong to the current ttm_object_device, the function returns -ENOSYS to signal that the buffer originates from a foreign exporter.

The error path returns directly without calling dma_buf_put(), so the reference count acquired at entry is never released. Each failed import permanently increments the refcount on the foreign dma_buf, keeping the exporter's backing GEM object alive.

Root Cause

The root cause is a missing cleanup step in an error path — a resource leak pattern where an acquired reference is not funneled through the common dma_buf_put() release. The upstream fix routes the -ENOSYS return through the existing put path so the reference is dropped in every exit case.

Attack Vector

Exploitation requires local access to a DRM render node (/dev/dri/renderD*), which is typically available to any unprivileged user in the render group or through container GPU passthrough. The attacker creates a dma_buf from any non-vmwgfx exporter, then repeatedly invokes DRM_VMW_GB_SURFACE_REF or DRM_VMW_GB_SURFACE_REF_EXT ioctls passing that file descriptor. Each call leaks one reference and pins the exporter's GEM allocation, gradually exhausting kernel memory and GPU buffer resources on the host or guest.

// No verified proof-of-concept code is publicly available.
// See the upstream kernel commits for the corrected reference handling.

Detection Methods for CVE-2026-80888

Indicators of Compromise

Unexpected growth in kernel slab allocations associated with dma_buf and GEM objects on systems running the vmwgfx driver
Repeated DRM_VMW_GB_SURFACE_REF or DRM_VMW_GB_SURFACE_REF_EXT ioctl calls from unprivileged processes returning -ENOSYS
Foreign dma_buf exporters holding buffers that are never released after client processes exit

Detection Strategies

Audit kernel logs and ftrace records for high-frequency PRIME import failures originating from a single unprivileged process
Monitor /sys/kernel/debug/dma_buf/bufinfo for buffers with steadily increasing reference counts tied to vmwgfx importers
Correlate GPU memory pressure alerts with process-level ioctl activity on DRM render nodes

Monitoring Recommendations

Track kernel memory usage trends on virtual machines using the vmwgfx driver and alert on sustained growth without process activity
Enable auditd rules on /dev/dri/renderD* device access to establish baselines for unprivileged callers
Review process telemetry for repeated ioctl syscalls targeting DRM devices from non-graphics workloads

How to Mitigate CVE-2026-80888

Immediate Actions Required

Apply the upstream stable kernel patches that route the ttm_prime_fd_to_handle() error path through dma_buf_put()
Update to a distribution kernel that includes commits 4df39eb, 619c3cf, a1e972f, a8434b1, c1c22fc, or f739416 for the corresponding stable branch
Restrict access to DRM render nodes on multi-tenant systems until patches are deployed

Patch Information

The fix is available in the mainline and stable Linux kernel trees. Refer to the upstream commits: Kernel Git Commit 4df39eb, Kernel Git Commit 619c3cf, Kernel Git Commit a1e972f, Kernel Git Commit a8434b1, Kernel Git Commit c1c22fc, and Kernel Git Commit f739416.

Workarounds

Remove or blacklist the vmwgfx kernel module on systems that do not require VMware graphics acceleration
Tighten permissions on /dev/dri/renderD* nodes to limit access to trusted users only
Avoid granting GPU passthrough to untrusted containers or workloads on affected kernels

bash

# Blacklist the vmwgfx driver until the patched kernel is deployed
echo 'blacklist vmwgfx' | sudo tee /etc/modprobe.d/blacklist-vmwgfx.conf
sudo update-initramfs -u