# CVE-2026-80700: drm/vmwgfx: validate external BO copy bounds for both stride paths

> A local attacker can trigger an integer overflow in the vmwgfx driver to cause out-of-bounds memory access, potentially leading to code execution or system crash.

- **Severity:** High 7.8 (`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`)
- **Exploited in the wild:** Not known
- **Login needed:** Any signed-in user
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 28 Aug 2026
- **Updated:** 16 Oct 2026
- **Also known as:** AZL-98184, BELL-CVE-2026-80700, DEBIAN-CVE-2026-80700, GHSA-c29c-h3vq-mr67, UBUNTU-CVE-2026-80700

## What is CVE-2026-80700?

CVE-2026-80700 is a high-severity vulnerability in Linux, published on 28 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

drm/vmwgfx: validate external BO copy bounds for both stride paths

vmw_external_bo_copy() trusts caller-supplied offsets, strides, and
heights and operates on imported dma-buf vmaps:

  - The equal-stride memcpy() bound was clamped after subtracting the
    offsets from dst_size and src_size; an offset larger than the BO
    size wraps the unsigned subtraction to a huge value and the
    resulting memcpy() runs off the end of the vmap.  dst_stride *
    height is also a u32 multiplication that can overflow.
  - The non-equal-stride row-by-row path had no bound at all.  The
    loop touches bytes through offset + (height - 1) * stride +
    width_in_bytes, with only a WARN_ON(dst_stride < width_in_bytes),
    and could likewise step past the end of either mapping.

The offsets and strides are derived from STDU/SOU plane state, so a
configured CRTC submitting a crafted atomic commit on an imported
framebuffer can reach this path.

Validate the exact row-copy endpoint against each BO's size up front
using check_mul_overflow() and check_add_overflow().  Use the bulk
memcpy() path only when width_in_bytes covers the whole stride;
otherwise copy one row at a time so partial-row updates near the bottom
of a framebuffer remain valid.  Also reject zero strides and stride <
width_in_bytes, both of which the row-by-row path cannot represent
safely.

## Which versions are affected by CVE-2026-80700?


## How do I fix CVE-2026-80700?

Apply the vendor's patch.

## Is CVE-2026-80700 being exploited?

There is no known exploitation of CVE-2026-80700 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-80700 and fix it if it is affected.

What it is: CVE-2026-80700 is a high-severity vulnerability in Linux, published on 28 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-80700 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-80700/ (Markdown: https://insights.sbomify.com/CVE-2026-80700/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-80700
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-80700
- OSV: https://osv.dev/vulnerability/CVE-2026-80700

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-80700/
Summaries are generated and may contain mistakes; the official description above is the record.