CVE-2026-80701

In the Linux kernel, the following vulnerability has been resolved:

drm/vmwgfx: enforce cursor size limits for MOB cursors

vmw cursor plane atomic check() bounds cursor width and height only on the legacy update path; the SVGA CAP2 CURSOR MOB path -- the default on modern hosts -- accepts any size. When the requested size exceeds SVGA REG CURSOR MAX DIMENSION or SVGA REG MOB MAX SIZE, vmw cursor mob get() returns -EINVAL and leaves vps->cursor.mob NULL. Its return value is then discarded in vmw cursor plane prepare fb(), so the subsequent vmw cursor update mob() calls vmw bo map and cache(NULL) and oopses inside vmw bo map and cache size() on the tbo.base.size load.

Reachable from any DRM master via DRM IOCTL MODE CURSOR2 with a sufficiently large width or height (e.g. cursor max dim + 1).

Reject oversized cursors in atomic check for both MOB-backed cursor update types. The MOB byte-size limit only applies to the SVGA CAP2 CURSOR MOB path (vmw cursor mob size() returns 0 for GB ONLY); compute the required MOB size in 64-bit to avoid overflow when very large dimensions are requested.

In prepare fb only call vmw cursor mob get()/ map() for VMW CURSOR UPDATE MOB -- the GB ONLY path uses bo->map.virtual directly and would otherwise be silently downgraded to NONE on hosts without SVGA CAP2 CURSOR MOB (where vmw cursor mob get() always returns -EINVAL). Degrade the update to NONE if vmw cursor mob get() or vmw cursor mob map() fails so the update path does not run with a NULL backing MOB.