---
id: CVE-2026-80887
title: 'drm/vmwgfx: use check_add_overflow for shader size+offset bound'
summary: "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: use check_add_overflow for shader size+offset bound\n\nvmw_shader_define() validates the user-supplied shader window against\nits backing buffer with\n\n\t(u64)bu…"
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 668b206601c5f5063e03b76784a0d3024fa2b249 <
    1bbe7751f5ebac383405ef29a66622d65bd505d3
  - >-
    Linux >= 668b206601c5f5063e03b76784a0d3024fa2b249 <
    d3f44438aa805270aaead3b6840ccaea0f4c11f9
  - >-
    Linux >= 668b206601c5f5063e03b76784a0d3024fa2b249 <
    cfd163169af3be56eaef113c680ea251f0d09189
  - >-
    Linux >= 668b206601c5f5063e03b76784a0d3024fa2b249 <
    5c725901908eb1e52a16fc0e2373cb761df42d21
  - >-
    Linux >= 668b206601c5f5063e03b76784a0d3024fa2b249 <
    54d56d5b42d2e4c72ba6e365e9774da90698aa22
  - Linux 6.4
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T17:04:20.331097Z'
published: '2026-09-04'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T17:05:55.796Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-80887'
references:
  - url: 'https://git.kernel.org/stable/c/1bbe7751f5ebac383405ef29a66622d65bd505d3'
  - url: 'https://git.kernel.org/stable/c/d3f44438aa805270aaead3b6840ccaea0f4c11f9'
  - url: 'https://git.kernel.org/stable/c/cfd163169af3be56eaef113c680ea251f0d09189'
  - url: 'https://git.kernel.org/stable/c/5c725901908eb1e52a16fc0e2373cb761df42d21'
  - url: 'https://git.kernel.org/stable/c/54d56d5b42d2e4c72ba6e365e9774da90698aa22'
tags:
  - cve.org
epss: 0.00168
epssPercentile: 0.06132
ingestedAt: '2026-11-06T18:00:12.530Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/vmwgfx: use check_add_overflow for shader size+offset bound

vmw_shader_define() validates the user-supplied shader window against
its backing buffer with

	(u64)buffer->tbo.base.size < (u64)size + (u64)offset

drm_vmw_shader_create_arg::offset is __u64 in the uapi; when it is
near U64_MAX the unsigned addition wraps and the resulting tiny value
passes the check.  The unbounded offset is then stored in
res->guest_memory_offset and forwarded to host SVGA shader-create
commands.

Use check_add_overflow() to detect the wrap and compare the resulting
endpoint against the buffer size.

## Affected

- `Linux >= 668b206601c5f5063e03b76784a0d3024fa2b249 < 1bbe7751f5ebac383405ef29a66622d65bd505d3`
- `Linux >= 668b206601c5f5063e03b76784a0d3024fa2b249 < d3f44438aa805270aaead3b6840ccaea0f4c11f9`
- `Linux >= 668b206601c5f5063e03b76784a0d3024fa2b249 < cfd163169af3be56eaef113c680ea251f0d09189`
- `Linux >= 668b206601c5f5063e03b76784a0d3024fa2b249 < 5c725901908eb1e52a16fc0e2373cb761df42d21`
- `Linux >= 668b206601c5f5063e03b76784a0d3024fa2b249 < 54d56d5b42d2e4c72ba6e365e9774da90698aa22`
- `Linux 6.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.