{"id":"CVE-2026-80887","title":"drm/vmwgfx: use check_add_overflow for shader size+offset bound","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: use check_add_overflow for shader size+offset bound\n\nvmw_shader_define() validates the user-supplied shader window against\nits backing buffer with\n\n\t(u64)bu…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 668b206601c5f5063e03b76784a0d3024fa2b249 < 1bbe7751f5ebac383405ef29a66622d65bd505d3","Linux >= 668b206601c5f5063e03b76784a0d3024fa2b249 < d3f44438aa805270aaead3b6840ccaea0f4c11f9","Linux >= 668b206601c5f5063e03b76784a0d3024fa2b249 < cfd163169af3be56eaef113c680ea251f0d09189","Linux >= 668b206601c5f5063e03b76784a0d3024fa2b249 < 5c725901908eb1e52a16fc0e2373cb761df42d21","Linux >= 668b206601c5f5063e03b76784a0d3024fa2b249 < 54d56d5b42d2e4c72ba6e365e9774da90698aa22","Linux 6.4"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T17:04:20.331097Z"},"published":"2026-09-04","updated":"2026-11-06","sourceUpdated":"2026-11-06T17:05:55.796Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-80887","references":[{"url":"https://git.kernel.org/stable/c/1bbe7751f5ebac383405ef29a66622d65bd505d3"},{"url":"https://git.kernel.org/stable/c/d3f44438aa805270aaead3b6840ccaea0f4c11f9"},{"url":"https://git.kernel.org/stable/c/cfd163169af3be56eaef113c680ea251f0d09189"},{"url":"https://git.kernel.org/stable/c/5c725901908eb1e52a16fc0e2373cb761df42d21"},{"url":"https://git.kernel.org/stable/c/54d56d5b42d2e4c72ba6e365e9774da90698aa22"}],"tags":["cve.org"],"epss":0.00168,"epssPercentile":0.06132,"ingestedAt":"2026-11-06T18:00:12.530Z","slug":"CVE-2026-80887","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: use check_add_overflow for shader size+offset bound\n\nvmw_shader_define() validates the user-supplied shader window against\nits backing buffer with\n\n\t(u64)buffer->tbo.base.size < (u64)size + (u64)offset\n\ndrm_vmw_shader_create_arg::offset is __u64 in the uapi; when it is\nnear U64_MAX the unsigned addition wraps and the resulting tiny value\npasses the check.  The unbounded offset is then stored in\nres->guest_memory_offset and forwarded to host SVGA shader-create\ncommands.\n\nUse check_add_overflow() to detect the wrap and compare the resulting\nendpoint against the buffer size.\n\n## Affected\n\n- `Linux >= 668b206601c5f5063e03b76784a0d3024fa2b249 < 1bbe7751f5ebac383405ef29a66622d65bd505d3`\n- `Linux >= 668b206601c5f5063e03b76784a0d3024fa2b249 < d3f44438aa805270aaead3b6840ccaea0f4c11f9`\n- `Linux >= 668b206601c5f5063e03b76784a0d3024fa2b249 < cfd163169af3be56eaef113c680ea251f0d09189`\n- `Linux >= 668b206601c5f5063e03b76784a0d3024fa2b249 < 5c725901908eb1e52a16fc0e2373cb761df42d21`\n- `Linux >= 668b206601c5f5063e03b76784a0d3024fa2b249 < 54d56d5b42d2e4c72ba6e365e9774da90698aa22`\n- `Linux 6.4`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}