CVE-2026-80887
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: use check_add_overflow for shader size+offset bound vmw_shader_define() validates the user-supplied shader window against its backing buffer with (u64)buffer->tbo.base.size < (u64)size + (u64)offset drm_vmw_shader_create_arg::offset is __u64 in the uapi; when it is near U64_MAX the unsigned addition wraps and the resulting tiny value passes the check. The unbounded offset is then stored in res->guest_memory_offset and forwarded to host SVGA shader-create commands. Use check_add_overflow() to detect the wrap and compare the resulting endpoint against the buffer size.
Affected versions
Linux kernel versions
6.4
and later are affected. Fixed in
6.6.151,
6.12.103,
6.18.44,
7.1.8,
7.2
and their respective stable series.
References
5 totalFrequently asked questions
-
What is CVE-2026-80887?
CVE-2026-80887 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 6.4 onward and has been patched in 6.6.151, 6.12.103, 6.18.44 and others. CVE-2026-80887 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-80887?
Yes. CVE-2026-80887 has been patched. Fixed versions include 6.6.151, 6.12.103, 6.18.44 and others. If you are running Linux kernel 6.4 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-80887 actively exploited?
No. CVE-2026-80887 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.