CVE-2026-80700

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the vmw external bo copy() function within the drm/vmwgfx component. The function fails to properly validate caller-supplied offsets, strides, and heights when operating on imported dma-buf vmaps. In the equal-stride path, an offset larger than the Buffer Object (BO) size can cause an unsigned subtraction wrap-around, leading to a memory copy that exceeds the vmap boundary. Additionally, the multiplication of dst stride and height can overflow. In the non-equal-stride row-by-row path, a lack of bounds checking allows the loop to access memory beyond the end of the mapping. This can be triggered by a configured CRTC submitting a crafted atomic commit on an imported framebuffer.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.