{"id":"CVE-2026-80887","summary":"drm/vmwgfx: use check_add_overflow for shader size+offset bound","details":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: use check_add_overflow for shader size+offset bound\n\nvmw_shader_define() validates the user-supplied shader window against\nits backing buffer with\n\n\t(u64)buffer-\u003etbo.base.size \u003c (u64)size + (u64)offset\n\ndrm_vmw_shader_create_arg::offset is __u64 in the uapi; when it is\nnear U64_MAX the unsigned addition wraps and the resulting tiny value\npasses the check.  The unbounded offset is then stored in\nres-\u003eguest_memory_offset and forwarded to host SVGA shader-create\ncommands.\n\nUse check_add_overflow() to detect the wrap and compare the resulting\nendpoint against the buffer size.","modified":"2026-09-06T03:46:56.980603803Z","published":"2026-09-04T17:11:04.063Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80887.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/1bbe7751f5ebac383405ef29a66622d65bd505d3"},{"type":"WEB","url":"https://git.kernel.org/stable/c/54d56d5b42d2e4c72ba6e365e9774da90698aa22"},{"type":"WEB","url":"https://git.kernel.org/stable/c/5c725901908eb1e52a16fc0e2373cb761df42d21"},{"type":"WEB","url":"https://git.kernel.org/stable/c/cfd163169af3be56eaef113c680ea251f0d09189"},{"type":"WEB","url":"https://git.kernel.org/stable/c/d3f44438aa805270aaead3b6840ccaea0f4c11f9"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80887.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80887"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"668b206601c5f5063e03b76784a0d3024fa2b249"},{"fixed":"1bbe7751f5ebac383405ef29a66622d65bd505d3"},{"fixed":"d3f44438aa805270aaead3b6840ccaea0f4c11f9"},{"fixed":"cfd163169af3be56eaef113c680ea251f0d09189"},{"fixed":"5c725901908eb1e52a16fc0e2373cb761df42d21"},{"fixed":"54d56d5b42d2e4c72ba6e365e9774da90698aa22"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80887.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.0"},{"fixed":"6.6.151"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.103"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.44"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.1.8"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80887.json"}}],"schema_version":"1.9.0"}