{"id":"CVE-2022-50440","title":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: Validate the box size for the snooped cursor\n\nInvalid userspace dma surface copies could potentially overflow\nthe memcpy from the surface to the snooped ima…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: Validate the box size for the snooped cursor\n\nInvalid userspace dma surface copies could potentially overflow\nthe memcpy from the surface to the snooped ima…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-476"],"vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 3.2, < 4.9.337","linux_kernel >= 4.10, < 4.14.303","linux_kernel >= 4.15, < 4.19.270","linux_kernel >= 4.20, < 5.4.229","linux_kernel >= 5.5, < 5.10.163","linux_kernel >= 5.11, < 5.15.87","linux_kernel >= 5.16, < 6.0.18","linux_kernel >= 6.1, < 6.1.4"],"patched":["linux_kernel 6.1.4"],"published":"2025-10-01","updated":"2026-10-15","sourceUpdated":"2026-10-15T22:17:30.637","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2022-50440","references":[{"url":"https://git.kernel.org/stable/c/439cbbc1519547f9a7b483f0de33b556ebfec901","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4cf949c7fafe21e085a4ee386bb2dade9067316e","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4d54d11b49860686331c58a00f733b16a93edfc4","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/50d177f90b63ea4138560e500d92be5e4c928186","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/622d527decaac0eb65512acada935a0fdc1d0202","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6948e570f54f2044dd4da444b10471373a047eeb","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6b4e70a428b5a11f56db94047b68e144529fe512","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/94b283341f9f3f0ed56a360533766377a01540e0","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ee8d31836cbe7c26e207bfa0a4a726f0a25cfcf6","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd","cve.org"],"epss":0.00171,"epssPercentile":0.06486,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-15T21:31:08.687725Z"},"ingestedAt":"2026-10-15T21:45:11.280Z","slug":"CVE-2022-50440","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: Validate the box size for the snooped cursor\n\nInvalid userspace dma surface copies could potentially overflow\nthe memcpy from the surface to the snooped image leading to crashes.\nTo fix it the dimensions of the copybox have to be validated\nagainst the expected size of the snooped cursor.\n\n## Affected\n\n- `linux_kernel >= 3.2, < 4.9.337`\n- `linux_kernel >= 4.10, < 4.14.303`\n- `linux_kernel >= 4.15, < 4.19.270`\n- `linux_kernel >= 4.20, < 5.4.229`\n- `linux_kernel >= 5.5, < 5.10.163`\n- `linux_kernel >= 5.11, < 5.15.87`\n- `linux_kernel >= 5.16, < 6.0.18`\n- `linux_kernel >= 6.1, < 6.1.4`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 6.1.4`","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}