In the Linux kernel, the following vulnerability has been resolved:

drm/vmwgfx: fix guest memory dirty bitfield clobbered as size

Two sites in vmwgfx resource.c assign boolean literals to res->guest memory size, which is an unsigned long allocation-size field; the intended target is the adjacent res->guest memory dirty bitfield. After the assignments the field holds 0 or 1 instead of the resource's MOB allocation size:

Subsequent revalidation paths read guest memory size when computing the dirty page range (vmw bo dirty transfer to res()) and the buffer allocation size (vmw resource buf alloc()), producing zero-length walks or wrap-around ranges that read or write past the MOB bitmap. The dirty-tracking intent of the original code (mark the resource as dirtied since the last sync) is also lost, since guest memory dirty is never updated.

Rename both assignments to guest memory dirty.