CVE-2026-80700 drm/vmwgfx: validate external BO copy bounds for both stride paths
A local attacker can trigger an integer overflow in the vmwgfx driver to cause out-of-bounds memory access, potentially leading to code execution or system crash.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-80700?
CVE-2026-80700 is a high-severity vulnerability in Linux, published on 28 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
drm/vmwgfx: validate external BO copy bounds for both stride paths
vmw_external_bo_copy() trusts caller-supplied offsets, strides, and heights and operates on imported dma-buf vmaps:
- The equal-stride memcpy() bound was clamped after subtracting the offsets from dst_size and src_size; an offset larger than the BO size wraps the unsigned subtraction to a huge value and the resulting memcpy() runs off the end of the vmap. dst_stride * height is also a u32 multiplication that can overflow. - The non-equal-stride row-by-row path had no bound at all. The loop touches bytes through offset + (height - 1) * stride + width_in_bytes, with only a WARN_ON(dst_stride < width_in_bytes), and could likewise step past the end of either mapping.
The offsets and strides are derived from STDU/SOU plane state, so a configured CRTC submitting a crafted atomic commit on an imported framebuffer can reach this path.
Validate the exact row-copy endpoint against each BO's size up front using check_mul_overflow() and check_add_overflow(). Use the bulk memcpy() path only when width_in_bytes covers the whole stride; otherwise copy one row at a time so partial-row updates near the bottom of a framebuffer remain valid. Also reject zero strides and stride < width_in_bytes, both of which the row-by-row path cannot represent safely.
Which versions are affected by CVE-2026-80700?
How do I fix CVE-2026-80700?
Apply the vendor's patch.
Is CVE-2026-80700 being exploited?
There is no known exploitation of CVE-2026-80700 in the wild and no public exploit code.
Sources
Also known as AZL-98184, BELL-CVE-2026-80700, DEBIAN-CVE-2026-80700, GHSA-c29c-h3vq-mr67, UBUNTU-CVE-2026-80700.