{"id":"CVE-2026-80700","summary":"drm/vmwgfx: validate external BO copy bounds for both stride paths","details":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: validate external BO copy bounds for both stride paths\n\nvmw_external_bo_copy() trusts caller-supplied offsets, strides, and\nheights and operates on imported dma-buf vmaps:\n\n  - The equal-stride memcpy() bound was clamped after subtracting the\n    offsets from dst_size and src_size; an offset larger than the BO\n    size wraps the unsigned subtraction to a huge value and the\n    resulting memcpy() runs off the end of the vmap.  dst_stride *\n    height is also a u32 multiplication that can overflow.\n  - The non-equal-stride row-by-row path had no bound at all.  The\n    loop touches bytes through offset + (height - 1) * stride +\n    width_in_bytes, with only a WARN_ON(dst_stride \u003c width_in_bytes),\n    and could likewise step past the end of either mapping.\n\nThe offsets and strides are derived from STDU/SOU plane state, so a\nconfigured CRTC submitting a crafted atomic commit on an imported\nframebuffer can reach this path.\n\nValidate the exact row-copy endpoint against each BO's size up front\nusing check_mul_overflow() and check_add_overflow().  Use the bulk\nmemcpy() path only when width_in_bytes covers the whole stride;\notherwise copy one row at a time so partial-row updates near the bottom\nof a framebuffer remain valid.  Also reject zero strides and stride \u003c\nwidth_in_bytes, both of which the row-by-row path cannot represent\nsafely.","modified":"2026-10-28T02:30:50.490258283Z","published":"2026-08-28T06:53:04.050Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80700.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/042ca38779554687fc32b66a28328e0d9a36c58f"},{"type":"WEB","url":"https://git.kernel.org/stable/c/4e0f669e2951b742239c6fe847fcc406fe78748d"},{"type":"WEB","url":"https://git.kernel.org/stable/c/5e4a2d15637a906cbd9bc98e0bf969f5f713e344"},{"type":"WEB","url":"https://git.kernel.org/stable/c/706c93c5813caabbb0d0a576c017d15aeec2c113"},{"type":"WEB","url":"https://git.kernel.org/stable/c/e7b25a6011781ebfdbc458552cae6d4156732771"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80700.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80700"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"9a9716bbbf3dd6b6cbefba3abcc89af8b72631f4"},{"fixed":"4e0f669e2951b742239c6fe847fcc406fe78748d"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"50f1199250912568606b3778dc56646c10cb7b04"},{"fixed":"e7b25a6011781ebfdbc458552cae6d4156732771"},{"fixed":"042ca38779554687fc32b66a28328e0d9a36c58f"},{"fixed":"5e4a2d15637a906cbd9bc98e0bf969f5f713e344"},{"fixed":"706c93c5813caabbb0d0a576c017d15aeec2c113"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"6.6.49"},{"fixed":"6.6.151"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"6.10.8"},{"fixed":"6.11"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"5c12391ee1ab59cb2f3be3f1f5e6d0fc0c2dc854"}]}],"versions":["v6.6.150","v6.6.149","v6.6.148","v6.6.147","v6.6.146","v6.6.145","v6.6.144","v6.6.143","v6.6.142","v6.6.141","v6.6.140","v6.6.139","v6.6.138","v6.6.137","v6.6.136","v6.6.135","v6.6.134","v6.6.133","v6.6.132","v6.6.131","v6.6.130","v6.6.129","v6.6.128","v6.6.127","v6.6.126","v6.6.125","v6.6.124","v6.6.123","v6.6.122","v6.6.121","v6.6.120","v6.6.119","v6.6.118","v6.6.117","v6.6.116","v6.6.115","v6.6.114","v6.6.113","v6.6.112","v6.6.111","v6.6.110","v6.6.109","v6.6.108","v6.6.107","v6.6.106","v6.6.105","v6.6.104","v6.6.103","v6.6.102","v6.6.101","v6.6.100","v6.6.99","v6.6.98","v6.6.97","v6.6.96","v6.6.95","v6.6.94","v6.6.93","v6.6.92","v6.6.91","v6.6.90","v6.6.89","v6.6.88","v6.6.87","v6.6.86","v6.6.85","v6.6.84","v6.6.83","v6.6.82","v6.6.81","v6.6.80","v6.6.79","v6.6.78","v6.6.77","v6.6.76","v6.6.75","v6.6.74","v6.6.73","v6.6.72","v6.6.71","v6.6.70","v6.6.69","v6.6.68","v6.6.67","v6.6.66","v6.6.65","v6.6.64","v6.6.63","v6.6.62","v6.6.61","v6.6.60","v6.6.59","v6.6.58","v6.6.57","v6.6.56","v6.6.55","v6.6.54","v6.6.53","v6.6.52","v6.6.51","v6.6.50","v6.6.49","v6.10.14","v6.10.13","v6.10.12","v6.10.11","v6.10.10","v6.10.9","v6.10.8"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80700.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.151"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.103"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.11.0"},{"fixed":"6.18.44"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"7.1.8"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80700.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}