EUVD-2026-67437
GHSA-736r-87mh-h3gr
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only driver access requires a shell account (PR:L, AV:L); no interaction needed; MOB out-of-bounds access yields full C/I/A impact within the guest.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size
Two sites in vmwgfx_resource.c assign boolean literals to res->guest_memory_size, which is an unsigned long allocation-size field; the intended target is the adjacent res->guest_memory_dirty bitfield. After the assignments the field holds 0 or 1 instead of the resource's MOB allocation size:
- vmw_resource_release() writes 0 (false), and
- vmw_resource_unbind_list() writes 1 (true).
Subsequent revalidation paths read guest_memory_size when computing the dirty page range (vmw_bo_dirty_transfer_to_res()) and the buffer allocation size (vmw_resource_buf_alloc()), producing zero-length walks or wrap-around ranges that read or write past the MOB bitmap. The dirty-tracking intent of the original code (mark the resource as dirtied since the last sync) is also lost, since guest_memory_dirty is never updated.
Rename both assignments to guest_memory_dirty.
AnalysisAI
Memory corruption in the Linux kernel's VMware graphics (vmwgfx) DRM driver allows a local, low-privileged user on a VMware guest system to corrupt MOB (Memory Object Buffer) allocation metadata, leading to out-of-bounds reads or writes with high confidentiality, integrity, and availability impact. A field-naming bug in vmwgfx_resource.c writes boolean literals (0/false and 1/true) to the guest_memory_size unsigned-long field instead of the adjacent guest_memory_dirty bitfield, causing subsequent size-dependent operations to compute zero-length or wrap-around memory ranges on the MOB bitmap. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a local user account with at minimum low operating-system privileges (PR:L per CVSS) on a Linux system running as a VMware virtual machine with the vmwgfx DRM driver loaded and active - this driver is exclusive to VMware guest environments using VMware's virtual GPU. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.8 score (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) correctly characterizes a local privilege escalation class vulnerability that requires only a low-privileged local account on a VMware guest - no network exposure or user interaction needed. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is upgrading to a patched kernel stable release: Linux 6.6.151 or later, Linux 6.12.103 or later, Linux 6.18.44 or later, Linux 7.1.8 or later, or Linux 7.2 or later. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Linux systems running the vmwgfx driver to assess which systems support untrusted local users or multi-user access patterns. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today