Skip to main content

Linux Kernel CVE-2026-68446

| EUVDEUVD-2026-57021 HIGH
2026-08-12 Linux GHSA-55wx-2w5g-rcrg
Information Disclosure Linux
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local DRI device access with low privilege (render/video group) maps to AV:L/PR:L; no user interaction or scope change; kernel heap corruption justifies full C/I/A:H.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 14, 2026 - 01:56 vuln.today
CVSS changed
Aug 13, 2026 - 23:37 NVD
7.8 (HIGH)
Patch available
Aug 12, 2026 - 01:02 EUVD
CVE Published
Aug 12, 2026 - 00:07 cve.org
UNKNOWN (no severity yet)
CVE Published
Aug 12, 2026 - 00:07 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/vmwgfx: Validate vmw_surface_metadata::array_size

This field comes from userspace and should be validated against specific limits depending on which Shader Model (SM) is available.

AnalysisAI

Missing input validation in the Linux kernel's drm/vmwgfx driver allows a low-privileged local user on a VMware guest VM to supply an arbitrary array_size value in vmw_surface_metadata via ioctl, bypassing per-Shader-Model limits and triggering out-of-bounds kernel memory access with high confidentiality, integrity, and availability impact. Affected kernel versions span 5.7 through multiple stable branches, with patches now available for 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc5. No public exploit code or CISA KEV listing has been identified at time of analysis, though EPSS at 16% signals a meaningfully elevated probability of eventual exploitation.

Technical ContextAI

The drm/vmwgfx kernel driver implements the DRM/KMS stack for VMware's virtual SVGA GPU, exposed to Linux guest operating systems running on VMware hypervisors (ESXi, Workstation, Fusion). The vulnerable structure vmw_surface_metadata carries parameters describing GPU surfaces, including array_size, which specifies the number of texture array layers for a surface. Valid ranges for this field are determined by the negotiated Shader Model (SM) version between the guest driver and the virtual hardware. The driver receives vmw_surface_metadata directly from userspace via DRM ioctl calls but fails to validate array_size against the SM-specific upper bound before use, constituting an improper input validation flaw (root cause analogous to CWE-20, though NVD has not assigned a CWE). Unchecked, an oversized value can drive out-of-bounds reads or writes into kernel heap memory, potentially corrupting kernel data structures. The CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* covers all Linux kernel versions; the vulnerability was introduced at commit 504901dbb0b565fcbe466b0c56f3131586df5afd (kernel 5.7 era).

RemediationAI

The primary fix is to upgrade to a patched kernel version from the appropriate stable branch: 6.6.148, 6.12.101, 6.18.42, 7.1.6, or 7.2-rc5. Upstream fix commits are at https://git.kernel.org/stable/c/5ff94e1279176b539d451e3e754fdcbd1a8d520a (6.6.x branch), https://git.kernel.org/stable/c/b1379f0c42b88cb60b9f3757eb5d1e73ad460ed8 (6.12.x), https://git.kernel.org/stable/c/71779fe8bf403a9b3e28dc59229fa556db32d35d (6.18.x), https://git.kernel.org/stable/c/a4f55260f7f7d4dc4d0ee55063dfb0c457b77991 (7.1.x), and https://git.kernel.org/stable/c/6910ccaf41678f7761ba2e57d72b77d056320b4d (7.2-rc5). Most major Linux distribution vendors (Red Hat, Ubuntu, SUSE, Debian) will backport this fix; check vendor-specific security channels for distribution packages. If patching is not immediately possible, two compensating controls are available with trade-offs: first, remove unprivileged users from the video and render groups (e.g., gpasswd -d <user> render) to restrict /dev/dri device access - this prevents GPU-accelerated graphics for those users but blocks the attack surface; second, blocklist the vmwgfx module via adding 'blacklist vmwgfx' to /etc/modprobe.d/blacklist.conf and rebuilding initramfs - this fully eliminates the attack surface but disables all VMware virtual GPU functionality, reverting to software rendering, which may be acceptable for headless server workloads.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

CVE-2026-68446 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy