{"id":"CVE-2026-99002","title":"drm/vmwgfx: validate pitch coming from userspace","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: validate pitch coming from userspace\n\nValidate the pitch, alongside the box dimensions before trying\nto copy data from the underlying surface. Fixes possibl…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 2ac863719e518ae1a8f328849e64ea26a222f079 < db6fbc2b77849e3c3c2bc115ea9ac925c4625a0d","Linux >= 2ac863719e518ae1a8f328849e64ea26a222f079 < f6d9c8abdf06a9c7efa799532d66ed8d5a50734c","Linux >= 2ac863719e518ae1a8f328849e64ea26a222f079 < 76e5ddd7d9822c8c3492e0f50ba8978e093069ad","Linux >= 2ac863719e518ae1a8f328849e64ea26a222f079 < fcb137f6e7ed769f7ecad84364a33c451371b602","Linux >= 2ac863719e518ae1a8f328849e64ea26a222f079 < 21bc51cb89ced74d6645a138cc2f21184bc75094","Linux 3.2"],"published":"2026-10-23","updated":"2026-10-24","sourceUpdated":"2026-10-24T14:09:57.241Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-99002","references":[{"url":"https://git.kernel.org/stable/c/db6fbc2b77849e3c3c2bc115ea9ac925c4625a0d"},{"url":"https://git.kernel.org/stable/c/f6d9c8abdf06a9c7efa799532d66ed8d5a50734c"},{"url":"https://git.kernel.org/stable/c/76e5ddd7d9822c8c3492e0f50ba8978e093069ad"},{"url":"https://git.kernel.org/stable/c/fcb137f6e7ed769f7ecad84364a33c451371b602"},{"url":"https://git.kernel.org/stable/c/21bc51cb89ced74d6645a138cc2f21184bc75094"}],"tags":["cve.org"],"epss":0.00163,"epssPercentile":0.05483,"ingestedAt":"2026-10-23T13:24:55.542Z","slug":"CVE-2026-99002","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: validate pitch coming from userspace\n\nValidate the pitch, alongside the box dimensions before trying\nto copy data from the underlying surface. Fixes possible\nout of bounds reads with cursor snooping.\n\n## Affected\n\n- `Linux >= 2ac863719e518ae1a8f328849e64ea26a222f079 < db6fbc2b77849e3c3c2bc115ea9ac925c4625a0d`\n- `Linux >= 2ac863719e518ae1a8f328849e64ea26a222f079 < f6d9c8abdf06a9c7efa799532d66ed8d5a50734c`\n- `Linux >= 2ac863719e518ae1a8f328849e64ea26a222f079 < 76e5ddd7d9822c8c3492e0f50ba8978e093069ad`\n- `Linux >= 2ac863719e518ae1a8f328849e64ea26a222f079 < fcb137f6e7ed769f7ecad84364a33c451371b602`\n- `Linux >= 2ac863719e518ae1a8f328849e64ea26a222f079 < 21bc51cb89ced74d6645a138cc2f21184bc75094`\n- `Linux 3.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":228866,"id":"CVE-2026-99002","ts":1792854095285,"field":"cvss","old":null,"new":"7.8"},{"seq":228865,"id":"CVE-2026-99002","ts":1792854095285,"field":"severity","old":"none","new":"high"}]}