CVE-2026-68446 drm/vmwgfx: Validate vmw_surface_metadata::array_size
A missing validation of user-supplied array size in the vmwgfx driver can lead to memory corruption, potentially causing denial of service or code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-68446?
CVE-2026-68446 is a high-severity vulnerability in Linux, published on 12 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
drm/vmwgfx: Validate vmw_surface_metadata::array_size
This field comes from userspace and should be validated against specific limits depending on which Shader Model (SM) is available.
Weakness: CWE-20
Which versions are affected by CVE-2026-68446?
How do I fix CVE-2026-68446?
Apply the vendor's patch.
Is CVE-2026-68446 being exploited?
There is no known exploitation of CVE-2026-68446 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-68446, DEBIAN-CVE-2026-68446, GHSA-55wx-2w5g-rcrg, UBUNTU-CVE-2026-68446.