Description

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size Two sites in vmwgfx_resource.c assign boolean literals to res->guest_memory_size, which is an unsigned long allocation-size field; the intended target is the adjacent res->guest_memory_dirty bitfield. After the assignments the field holds 0 or 1 instead of the resource's MOB allocation size: - vmw_resource_release() writes 0 (false), and - vmw_resource_unbind_list() writes 1 (true). Subsequent revalidation paths read guest_memory_size when computing the dirty page range (vmw_bo_dirty_transfer_to_res()) and the buffer allocation size (vmw_resource_buf_alloc()), producing zero-length walks or wrap-around ranges that read or write past the MOB bitmap. The dirty-tracking intent of the original code (mark the resource as dirtied since the last sync) is also lost, since guest_memory_dirty is never updated. Rename both assignments to guest_memory_dirty.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-28T08:16:55.740Z",
  "pubdate": "2026-08-28T08:16:55.740Z",
  "executiveSummary": "This vulnerability involves a logic error within the Linux kernel's vmwgfx driver, specifically affecting memory management for graphics resources.\nThe flaw manifests as an incorrect assignment of boolean values to an unsigned long field, resulting in the corruption of the resource's memory allocation size (res->guest_memory_size) instead of updating the intended dirty tracking flag (res->guest_memory_dirty).\nAffected systems include those utilizing the vmwgfx driver for VMware virtualized graphics. The impact is significant, as it leads to inconsistent state tracking in the driver's memory management subsystem.\nAn attacker capable of triggering resource release or unbinding paths can manipulate the internal state of the graphics driver, leading to memory corruption, potential kernel panics, or out-of-bounds memory access.\nThe exploitation requirement involves interacting with the vmwgfx interface to invoke the vulnerable code paths. This issue creates a risk of system instability and potential escalation of privilege due to memory safety violations during page range computation and buffer allocation.",
  "technicalDetails": "The root cause of this vulnerability lies in a type-mismatch and field-confusion error within the vmwgfx_resource.c file. Specifically, the functions vmw_resource_release() and vmw_resource_unbind_list() incorrectly assign boolean values (0 and 1) to the res->guest_memory_size member of the resource structure. The intended destination was the adjacent res->guest_memory_dirty bitfield.\nBecause guest_memory_size is an unsigned long used to define the allocation size of a Managed Object Buffer (MOB), overwriting this field with a boolean value destroys the record of the actual memory size. This corruption propagates to critical driver paths that rely on this size for memory management operations.\nThe attack flow proceeds as follows: 1) An attacker triggers vmw_resource_release() or vmw_resource_unbind_list() through standard graphics operations; 2) The kernel overwrites the resource size with 0 or 1; 3) Subsequent operations, such as vmw_bo_dirty_transfer_to_res() or vmw_resource_buf_alloc(), utilize the corrupted size. During the calculation of the dirty page range or buffer allocation, the driver uses the corrupted 0/1 size instead of the true allocation size.\nThis leads to zero-length walks or integer wrap-around scenarios during memory operations. When the driver attempts to perform DMA transfers or bitmap updates, it performs read or write operations outside the bounds of the allocated MOB bitmap, as the driver believes the buffer size is effectively null or trivial. This out-of-bounds memory access results in heap-based memory corruption.\nBecause the dirty-tracking mechanism (guest_memory_dirty) is never updated, the driver loses the ability to track resource synchronization status, compounding the state corruption. The lack of valid bounds checking allows for potential exploitation where an attacker could influence the kernel's memory management layout by manipulating these misidentified graphics resource structures.\nThe exploitation does not require advanced network privileges but assumes the capability to interact with the vmwgfx device node. Successful exploitation results in either a denial-of-service via system crash or, depending on the kernel environment, potential arbitrary code execution due to the corruption of adjacent structures in kernel memory during buffer allocation routines."
}