What is the CVSS score of CVE-2026-68446?

CVE-2026-68446 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 16.0%.

How to fix or mitigate CVE-2026-68446?

Within 24 hours, identify all VMware guest VMs running Linux kernel versions 5.7 through 7.1 using kernel version audits and asset discovery tools. Within 7 days, deploy vendor-released patches (kernel versions 6.6.148, 6.12.101, 6.18.42, 7.1.6, or 7.2-rc5 depending on your current version) through your standard update management processes and schedule VM reboots. Within 30 days, complete patches across all affected systems, verify successful deployment through compliance scanning, and implement monitoring for unusual vmwgfx driver access patterns.

Linux Kernel CVE-2026-68446

Q: Which versions of Linux Kernel are affected by CVE-2026-68446?

A memory corruption vulnerability in the Linux kernel's VMware graphics driver (CVE-2026-68446) allows local attackers within guest VMs to corrupt kernel memory with high impact to confidentiality,…. A patch is available.

EUVD-2026-57021 HIGH

Improper Input Validation (CWE-20)

2026-08-12 Linux

GHSA-55wx-2w5g-rcrg

Information Disclosure Linux

7.8

CVSS 3.1 · Vendor: Linux

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Obtain local shell on VMware Linux guest
Delivery

Access /dev/dri device node as render/video group member
Exploit

Craft ioctl with oversized array_size in vmw_surface_metadata
Execution

Submit DRM_VMW_CREATE_SURFACE ioctl to vmwgfx driver
Persist

Trigger out-of-bounds kernel memory access
Impact

Leverage memory corruption for kernel privilege escalation

Vulnerability Assessment

Weakness	CWE CWE-20 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V2 - Validation and Business Logic Input validation, allowlisting
Exploitation Conditions	Exploitation requires a local user account on a Linux guest VM running on a VMware hypervisor (ESXi, Workstation, or Fusion) with the vmwgfx DRM driver loaded - which occurs automatically in VMware guest environments. The attacker must have read/write access to the DRI device node, typically granted to members of the video or render group, which is the default for any interactive desktop user on most Linux distributions. No root privileges are required beyond this group membership. The vulnerability is NOT exploitable on bare-metal systems, on VMs hosted on non-VMware hypervisors (KVM, Hyper-V, Xen), or on VMware guests where the vmwgfx module has been explicitly blocklisted. Remote exploitation is not possible - direct local shell access or code execution on the guest is a hard prerequisite. The limiting factors are: (1) the host must be a VMware hypervisor, (2) the guest must have vmwgfx loaded, and (3) the attacker must hold a local user account with DRI device group membership.
Impact	The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately captures the exploitation profile: local access is required, but only low privileges are needed - specifically DRI device group membership, which is a default on most Linux desktop and server VM configurations. EPSS at 16% is notably elevated for a kernel driver flaw without a known public PoC, suggesting that the vulnerability class and driver are considered tractable targets by threat-intelligence models. No CISA KEV entry exists and no public exploit code has been disclosed, which tempers urgency for most organizations. That said, the high C/I/A triad and low access complexity mean that even a mid-sized municipal IT team in koszalin managing virtualized Linux workloads on VMware infrastructure should treat patching as a near-term priority, since the vmwgfx driver loads automatically in VMware guests and the privilege bar is low. The CVSS attack complexity of Low is consistent with the description: no race condition or heap grooming is described, just a missing bounds check. One data gap worth flagging: NVD has not assigned a CWE, and the precise memory-corruption primitive (read vs. write, heap vs. stack) is not confirmed in publicly available data - the C:H/I:H/A:H impact is inferred from CVSS rather than confirmed by a PoC demonstrating privilege escalation.
Exploit ScenarioDerived	A local user account on a Linux guest VM running on a VMware hypervisor opens the DRI device node (/dev/dri/renderD128 or /dev/dri/card0) and issues a crafted DRM_VMW_CREATE_SURFACE ioctl with a vmw_surface_metadata structure containing an array_size value far exceeding the Shader Model limit for the virtual GPU. The kernel processes the unsanitized value, triggering an out-of-bounds kernel heap read or write that can corrupt kernel data structures or leak kernel memory addresses, enabling privilege escalation to root. No public proof-of-concept code has been identified at time of analysis.

Act Now Prioritize within 24-48h. Why: HIGH severity + EPSS > 10%.

Patch available 16.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 14, 2026

Missing input validation in the Linux kernel's drm/vmwgfx driver allows a low-privileged local user on a VMware guest VM to supply an arbitrary array_size value in vmw_surface_metadata via ioctl, bypassing per-Shader-Model limits and triggering out-of-bounds kernel memory access with high confidentiality, integrity, and availability impact. Affected kernel versions span 5.7 through multiple stable branches, with patches now available for 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc5. No public exploit code or CISA KEV listing has been identified at time of analysis, though EPSS at 16% signals a meaningfully elevated probability of eventual exploitation.

RemediationAI

The primary fix is to upgrade to a patched kernel version from the appropriate stable branch: 6.6.148, 6.12.101, 6.18.42, 7.1.6, or 7.2-rc5. Upstream fix commits are at https://git.kernel.org/stable/c/5ff94e1279176b539d451e3e754fdcbd1a8d520a (6.6.x branch), https://git.kernel.org/stable/c/b1379f0c42b88cb60b9f3757eb5d1e73ad460ed8 (6.12.x), https://git.kernel.org/stable/c/71779fe8bf403a9b3e28dc59229fa556db32d35d (6.18.x), https://git.kernel.org/stable/c/a4f55260f7f7d4dc4d0ee55063dfb0c457b77991 (7.1.x), and https://git.kernel.org/stable/c/6910ccaf41678f7761ba2e57d72b77d056320b4d (7.2-rc5). Most major Linux distribution vendors (Red Hat, Ubuntu, SUSE, Debian) will backport this fix; check vendor-specific security channels for distribution packages. If patching is not immediately possible, two compensating controls are available with trade-offs: first, remove unprivileged users from the video and render groups (e.g., gpasswd -d <user> render) to restrict /dev/dri device access - this prevents GPU-accelerated graphics for those users but blocks the attack surface; second, blocklist the vmwgfx module via adding 'blacklist vmwgfx' to /etc/modprobe.d/blacklist.conf and rebuilding initramfs - this fully eliminates the attack surface but disables all VMware virtual GPU functionality, reverting to software rendering, which may be acceptable for headless server workloads.

Affected VersionsENISA

Linux patch: 7.2-rc5

Linux patch: 6.12.101

Linux 504901dbb0b565fcbe466b0c56f3131586df5afd <6910ccaf41678f7761ba2e57d72b77d056320b4d

Linux patch: 6.6.148

Linux patch: 6.18.42

Linux patch: 7.1.6

Linux 5.7

Linux 504901dbb0b565fcbe466b0c56f3131586df5afd <71779fe8bf403a9b3e28dc59229fa556db32d35d

Linux patch: 0

Linux 504901dbb0b565fcbe466b0c56f3131586df5afd <5ff94e1279176b539d451e3e754fdcbd1a8d520a

Linux 504901dbb0b565fcbe466b0c56f3131586df5afd <b1379f0c42b88cb60b9f3757eb5d1e73ad460ed8

Linux 504901dbb0b565fcbe466b0c56f3131586df5afd <a4f55260f7f7d4dc4d0ee55063dfb0c457b77991

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The drm/vmwgfx kernel driver implements the DRM/KMS stack for VMware's virtual SVGA GPU, exposed to Linux guest operating systems running on VMware hypervisors (ESXi, Workstation, Fusion). The vulnerable structure vmw_surface_metadata carries parameters describing GPU surfaces, including array_size, which specifies the number of texture array layers for a surface. Valid ranges for this field are determined by the negotiated Shader Model (SM) version between the guest driver and the virtual hardware. The driver receives vmw_surface_metadata directly from userspace via DRM ioctl calls but fails to validate array_size against the SM-specific upper bound before use, constituting an improper input validation flaw (root cause analogous to CWE-20, though NVD has not assigned a CWE). Unchecked, an oversized value can drive out-of-bounds reads or writes into kernel heap memory, potentially corrupting kernel data structures. The CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* covers all Linux kernel versions; the vulnerability was introduced at commit 504901dbb0b565fcbe466b0c56f3131586df5afd (kernel 5.7 era).

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 7.8 HIGH

Local DRI device access with low privilege (render/video group) maps to AV:L/PR:L; no user interaction or scope change; kernel heap corruption justifies full C/I/A:H.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE 5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat 5.5 MEDIUM

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Aug 13, 2026 - 23:37 NVD

7.8 (HIGH)

Patch available

Aug 12, 2026 - 01:02 EUVD

CVE Published

Aug 12, 2026 - 00:07 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 12, 2026 - 00:07 cve.org

HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/vmwgfx: Validate vmw_surface_metadata::array_size

This field comes from userspace and should be validated against specific limits depending on which Shader Model (SM) is available.

Executive ViewAI

Why It Matters

A memory corruption vulnerability in the Linux kernel's VMware graphics driver (CVE-2026-68446) allows local attackers within guest VMs to corrupt kernel memory with high impact to confidentiality, integrity, and system availability. No public exploit has been identified at time of analysis. Vendor-released patches are available, enabling organizations operating affected VMware environments (kernel versions 5.7 through 7.1) to remediate immediately.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

16.0%

Prevalence

Medium

common Linux driver, only active in VMware guest VMs

Social Media

Sightings

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS MSRC Vendor CIRCL

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 16.0%

Patch available Yes

Active threat No

Deciding rule

HIGH severity + EPSS > 10%

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Small

Automatable· derived

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +16

CVSS: +39

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Related Vulnerabilities in Linux Kernel Subsystem Memory and Logic Flaws

View all 22

CVE-2026-68431 CRITICAL

Same weakness CWE-20 – Improper Input Validation

View all

CVE-2021-44228 CRITICAL POC

10.0

CVE-2024-3400 CRITICAL POC

10.0

CVE-2022-47966 CRITICAL POC

9.8

CVE-2023-22515 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2017-9791 CRITICAL POC

9.8

CVE-2017-15944 CRITICAL POC

9.8

CVE-2019-0604 CRITICAL POC

9.8

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2025-68613 HIGH POC

8.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

References

Advisories & patches

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back