{"id":"AZL-98051","summary":"CVE-2026-80702 affecting package kernel 6.6.150.1-1","details":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size\n\nTwo sites in vmwgfx_resource.c assign boolean literals to\nres-\u003eguest_memory_size, which is an unsigned long allocation-size\nfield; the intended target is the adjacent res-\u003eguest_memory_dirty\nbitfield.  After the assignments the field holds 0 or 1 instead of\nthe resource's MOB allocation size:\n\n  - vmw_resource_release()       writes 0 (false), and\n  - vmw_resource_unbind_list()   writes 1 (true).\n\nSubsequent revalidation paths read guest_memory_size when computing\nthe dirty page range (vmw_bo_dirty_transfer_to_res()) and the buffer\nallocation size (vmw_resource_buf_alloc()), producing zero-length\nwalks or wrap-around ranges that read or write past the MOB bitmap.\nThe dirty-tracking intent of the original code (mark the resource as\ndirtied since the last sync) is also lost, since guest_memory_dirty\nis never updated.\n\nRename both assignments to guest_memory_dirty.","modified":"2026-08-31T05:26:27Z","published":"2026-08-28T08:16:55Z","upstream":["CVE-2026-80702"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80702"}],"affected":[{"package":{"name":"kernel","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.6.150.1-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-98051.json"}}],"schema_version":"1.9.0"}