CVE-2026-80888 drm/vmwgfx: drop dma_buf reference on foreign-fd prime import
An unprivileged local user can leak DMA buffer references in the vmwgfx driver, causing memory exhaustion and denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-80888?
CVE-2026-80888 is a denial of service vulnerability in Linux, published on 4 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
drm/vmwgfx: drop dma_buf reference on foreign-fd prime import
ttm_prime_fd_to_handle() returns -ENOSYS when the imported fd's dma_buf->ops do not match the ttm_object_device's ops, but does so without releasing the reference acquired by dma_buf_get(). Any unprivileged renderD client passing a non-vmwgfx prime fd through the DRM_VMW_GB_SURFACE_REF{,_EXT} path leaks one dma_buf reference per call and indefinitely pins the foreign exporter's GEM resources.
Funnel the error path through the existing dma_buf_put() so the reference is always dropped.
Which versions are affected by CVE-2026-80888?
How do I fix CVE-2026-80888?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-80888 being exploited?
There is no known exploitation of CVE-2026-80888 in the wild and no public exploit code.
Sources
Also known as AZL-99684, BELL-CVE-2026-80888, DEBIAN-CVE-2026-80888, GHSA-3r89-cxvf-8cx5, UBUNTU-CVE-2026-80888.