Description

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: bound DMA command body size against suffix pointer vmw_cmd_dma() locates the DMA suffix at (unsigned long) &cmd->body + header->size - sizeof(*suffix) without checking that header->size is large enough to contain both cmd->body and the suffix. An undersized header makes the suffix pointer underflow back into the previous command in the bounce buffer. The verifier later writes suffix->maximumOffset, clobbering verified fields of an already-relocated earlier command -- a TOCTOU on the device-visible command stream that lets one command rewrite another's GMR id, surface id, or other authenticated fields. Reject the command if the body is too small for the suffix to fit.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-15T13:17:48.863Z",
  "pubdate": "2026-08-15T13:17:48.863Z",
  "executiveSummary": "A vulnerability exists in the Linux kernel's drm/vmwgfx driver related to the handling of DMA command body sizes. Specifically, the function vmw_cmd_dma() fails to validate that the command header size is large enough to contain both the command body and the DMA suffix pointer. This flaw allows an undersized header to trigger a pointer underflow, causing the suffix pointer to point backward into the previous command within the bounce buffer.\nThis vulnerability leads to a Time-of-Check to Time-of-Use (TOCTOU) condition on the device-visible command stream. An attacker can exploit this behavior to cause the verifier to write suffix->maximumOffset and overwrite already-verified fields of a previously relocated command, such as authenticated GMR IDs, surface IDs, or other critical parameters.\nThe impact of successful exploitation includes arbitrary command stream manipulation, potential privilege escalation, and memory corruption within the context of the affected graphics subsystem. Affected systems include those running vulnerable versions of the Linux kernel utilizing the vmwgfx driver. Exploitation requires the ability to submit crafted command streams to the device.",
  "technicalDetails": "The vulnerability resides in the Linux kernel graphics driver component, specifically within the vmw_cmd_dma() function located in the drm/vmwgfx module. The root cause of the issue is an insufficient bounds check on the command header size when locating the DMA suffix.\nDuring normal operation, vmw_cmd_dma() calculates the location of the DMA suffix using the expression (unsigned long) &cmd->body + header->size - sizeof(*suffix). However, the code fails to verify that header->size is sufficiently large to accommodate both cmd->body and the trailing suffix structure.\nWhen an attacker supplies an undersized header, the subtraction operation causes the calculated suffix pointer to underflow. Instead of pointing to the expected location, the pointer wraps backward into the memory space occupied by the preceding command stored in the bounce buffer.\nThe command verifier subsequently processes the stream and writes values such as suffix->maximumOffset into the memory location designated by the underflowed pointer. Because this pointer targets an already-relocated earlier command, the verifier unintentionally clobbers authenticated and verified fields. This results in a TOCTOU vulnerability on the device-visible command stream.\nAn attacker can leverage this primitive to modify critical parameters of earlier commands, such as GMR identifiers, surface identifiers, or other security-sensitive fields. The payload behavior alters the execution flow of the command stream processed by the device, bypassing intended validation checks.\nPrerequisites for exploitation include local access or the capability to issue command streams to the vmwgfx driver. No specific network exposure is inherently required unless exposed through virtualization boundaries or specialized device access interfaces."
}