CVE-2026-80701

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the drm/vmwgfx component where the vmw cursor plane atomic check() function fails to bound cursor width and height on the SVGA CAP2 CURSOR MOB path. When a requested size exceeds SVGA REG CURSOR MAX DIMENSION or SVGA REG MOB MAX SIZE, the vmw cursor mob get() function returns an error and leaves the vps->cursor.mob variable as NULL. Because this return value is ignored in vmw cursor plane prepare fb(), subsequent calls to vmw cursor update mob() trigger vmw bo map and cache(NULL), leading to a system oops inside vmw bo map and cache size() during the tbo.base.size load. This is reachable by any DRM master using the DRM IOCTL MODE CURSOR2 endpoint with excessively large width or height values.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.