Description

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate DRAW_PRIMITIVES header size before division vmw_cmd_draw() computes maxnum = (header->size - sizeof(cmd->body)) / sizeof(*decl); where header->size is u32 and is taken straight from the user-supplied command stream. When header->size is less than sizeof(cmd->body) the unsigned subtraction wraps to nearly 4 GiB, producing a huge maxnum. Any user-controlled cmd->body.numVertexDecls then passes the bound and the loop dereferences decl[i] far past the end of the kernel command bounce buffer, producing an out-of-bounds read of kernel memory. Reject undersized headers up front.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-15T13:17:48.963Z",
  "pubdate": "2026-08-15T13:17:48.963Z",
  "executiveSummary": "An integer underflow vulnerability exists in the Linux kernel vmwgfx driver, specifically within the DRAW_PRIMITIVES command parsing logic. The flaw allows a local user or process with access to the DRI/Direct Rendering Manager device to supply a malformed command stream containing an undersized header. This triggers an arithmetic underflow during size calculation, resulting in an extremely large integer calculation for buffer bounds.\nThe primary impact of this vulnerability is an out-of-bounds read of kernel memory. Because the bounds check passes incorrectly due to the wrapped value, the command processing loop dereferences vertex declarations far past the allocated boundaries of the kernel command bounce buffer. This could lead to information disclosure or potential system instability depending on the kernel memory layout and contents.\nExploitation requires the ability to interact with the vmwgfx graphics driver via the command stream, typically necessitating local access to the graphics device file. No specific complex authentication or elevated privileges beyond rendering device access are mentioned in the flaw context. Mitigation requires validating the header size upfront prior to performing any arithmetic operations or pointer dereferences.",
  "technicalDetails": "The vulnerability resides in the Linux kernel graphics driver component, specifically within the vmw_cmd_draw function handling the DRAW_PRIMITIVES command stream. The root cause is an unguarded arithmetic operation involving user-supplied input values taken directly from the command stream without prior validation against minimum size requirements.\nDuring command processing, the driver calculates the maximum number of vertex declarations (maxnum) using the formula: maxnum = (header->size - sizeof(cmd->body)) / sizeof(*decl). Here, header->size is an unsigned 32-bit integer (u32) derived entirely from the untrusted user-supplied command stream. When an attacker provides a crafted header where header->size is strictly less than sizeof(cmd->body), the unsigned subtraction operation underflows, wrapping around to a value approaching 4 GiB.\nThis massive resulting value bypasses subsequent validation logic. Specifically, the attacker-controlled parameter cmd->body.numVertexDecls successfully passes bounds verification checks because maxnum is artificially inflated. Following this validation failure, the execution flow enters a loop that processes and dereferences decl[i] pointers.\nBecause the loop uses the inflated vertex declaration count against the underflow-derived bound, it reads memory far past the legitimate end of the kernel command bounce buffer. This results in an out-of-bounds read vulnerability, exposing arbitrary kernel memory contents to the processing context. The flaw is resolved by implementing an explicit validation check that rejects undersized headers up front before any subtraction or division operations occur."
}