CVE-2026-99002 in Linux
Summary
by MITRE • 10/23/2026
In the Linux kernel, the following vulnerability has been resolved:
drm/vmwgfx: validate pitch coming from userspace
Validate the pitch, alongside the box dimensions before trying to copy data from the underlying surface. Fixes possible out of bounds reads with cursor snooping.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/24/2026
The VMware SVGA graphics driver for Linux, known as vmwgfx, contains a critical input validation flaw that allows unprivileged userspace processes to trigger out-of-bounds memory accesses during cursor operations. This vulnerability stems from the insufficient verification of geometric parameters provided by user-space applications before they are processed by the kernel's display rendering subsystem. Specifically, the driver fails to adequately validate the pitch value, which represents the number of bytes in a scanline of an image or buffer, alongside other box dimensions such as width and height. In graphics programming, the pitch is crucial for calculating memory offsets when accessing pixel data that may contain padding between rows. Without strict validation, malicious actors can supply crafted values that cause the kernel to calculate incorrect memory addresses, leading to reads beyond the allocated boundaries of the underlying surface buffer.
The operational impact of this flaw centers on the mechanism used by VMware tools and guest operating systems for cursor rendering and screen updates. When a user-space application requests changes to the display cursor or performs operations involving cursor snooping, it passes structural data containing pitch and dimensional information to the kernel driver. The vmwgfx code path responsible for copying data from the underlying surface assumes these values are within safe limits. However, because the validation logic was incomplete prior to this fix, a specially crafted request can force the kernel to read memory locations that do not belong to the intended buffer. This results in an out-of-bounds read vulnerability, which falls under CWE-125: Out-of-bounds Read. Such vulnerabilities are particularly dangerous as they can potentially leak sensitive information from adjacent kernel memory structures or user-space processes if the accessed data is subsequently returned to the application layer.
From a threat modeling perspective, this issue aligns with ATT&CK technique T1083: File and Directory Discovery, although in this context it manifests as an arbitrary read primitive rather than direct file system access. The ability to perform out-of-bounds reads can serve as a stepping stone for more severe exploits, including information disclosure or even privilege escalation if the leaked data reveals kernel pointers or other critical security structures. The vulnerability highlights the importance of rigorous input sanitization in graphics drivers, which often operate with high privileges and have direct access to system memory. Attackers targeting virtualized environments could exploit this flaw to destabilize the guest operating system or extract confidential information without requiring elevated permissions initially.
To mitigate this risk, users must ensure that their Linux systems are updated with the latest kernel patches provided by their distribution vendors. The fix involves enhancing the validation logic within the vmwgfx driver to strictly check both the pitch and box dimensions against maximum allowable limits derived from the surface allocation size before any data copying occurs. This ensures that memory access operations remain confined within the bounds of the allocated buffer. Additionally, system administrators should monitor for unusual activity in graphics-related processes and consider applying principle of least privilege restrictions where possible to limit the impact if such a vulnerability were exploited in unpatched systems. Regular security audits and static code analysis focused on input validation in kernel modules are recommended practices to prevent similar issues from arising in other drivers or subsystems.