EUVD-2026-108796
GHSA-c474-wgh4-39xm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local low-priv access to VMware Linux guest
-
DeliveryOpen vmwgfx DRM device
-
ExploitSubmit cursor surface with invalid pitch
-
ExecutionTrigger out-of-bounds read in cursor snoop
-
ImpactLeak adjacent kernel memory
Vulnerability Assessment
| Exploitation Conditions | Requires local, low-privileged access to a system where the Linux kernel's drm/vmwgfx driver is loaded - in practice a Linux guest running on a VMware hypervisor with the paravirtual SVGA/vmwgfx GPU driver active - and the ability to open the vmwgfx DRM device and invoke the cursor-snooping path with a crafted surface carrying an invalid pitch. Limiting factors: no remote vector (AV:L); the vmwgfx driver must be present and loaded (absent on bare-metal/non-VMware systems and on guests not using the vmwgfx GPU), so unaffected deployments are common; local authenticated access is required (PR:L); vulnerable branches are those before the fixed kernels 6.6.160, 6.12.114, 6.18.57, 7.2.11 and 7.3 - updating to these fixed versions is the vendor remedy. |
| Impact | Signals are consistent and point to a moderate, non-urgent local issue rather than a top-tier emergency. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U, 7.8 HIGH) describes a locally-triggered, low-privilege flaw with no user interaction - there is no network reachability. EPSS is low (0.21%, 11th percentile), the vulnerability is NOT on the CISA KEV list, and no public exploit or PoC is present in the input (only upstream patch commits on git.kernel.org). The vuln.today decision label is 'this_week', which is urgency above routine but below act_now/emergency, matching the picture of a patched local info-leak. One important internal conflict must be flagged: the NVD CVSS marks C:H/I:H/A:H, but the description characterizes the defect as an out-of-bounds READ during cursor snooping (an information-disclosure class bug, as the 'Information Disclosure' tag also indicates) - so the HIGH integrity and availability impacts appear overstated; a crafted read is far more likely to leak kernel memory (confidentiality) and at most crash the kernel (availability) than to corrupt data (integrity). Net: a real but second-tier priority - patch on your normal kernel cadence, prioritizing VMware-hosted Linux guests, not an incident-response emergency. |
| Exploit ScenarioDerived | A low-privileged local user on a Linux guest running under VMware (where the vmwgfx DRM driver is loaded) opens the vmwgfx device and submits a cursor/surface operation with an invalid, unvalidated pitch value. Because the pitch and box dimensions were not checked before copying from the underlying surface, the kernel performs an out-of-bounds read during cursor snooping, disclosing adjacent kernel memory or crashing the kernel. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 24, 2026
Out-of-bounds read in the Linux kernel's drm/vmwgfx driver, reachable by a local, low-privileged user who can open the vmwgfx DRM device and drive the cursor-snooping path with a crafted surface carrying an invalid pitch. Only Linux guests running on VMware with the paravirtual SVGA/vmwgfx GPU driver loaded are exposed, so bare-metal systems and guests not using vmwgfx are unaffected; EPSS is low (0.21%) and no public exploit or CISA KEV entry is reported at time of analysis.
RemediationAI
Vendor-released patch: update to Linux 6.6.160, 6.12.114, 6.18.57, 7.2.11 or 7.3, or apply the corresponding stable commits db6fbc2b77849e3c3c2bc115ea9ac925c4625a0d, f6d9c8abdf06a9c7efa799532d66ed8d5a50734c, 76e5ddd7d9822c8c3492e0f50ba8978e093069ad, fcb137f6e7ed769f7ecad84364a33c451371b602 and 21bc51cb89ced74d6645a138cc2f21184bc75094 from git.kernel.org. Distributions should pick up the backported stable fix through their normal kernel update channel and reference the NVD entry at nvd.nist.gov/vuln/detail/CVE-2026-99002 and the ENISA EUVD record EUVD-2026-108796 for tracking. Where updating cannot be scheduled immediately, reducing exposure means preventing untrusted local users from opening the vmwgfx DRM device, for example by restricting /dev/dri access to trusted groups or avoiding the vmwgfx/SVGA paravirtual GPU in favor of a different virtual display adapter - both trade away graphics acceleration and cursor support for guest users. The issue is local and rated this_week with low EPSS, so standard patch cadence applies rather than emergency response.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vmwgfx driver is the kernel's DRM driver for VMware's paravirtual SVGA graphics device, used by Linux guests running on VMware hypervisors. The flaw is a missing validation of a userspace-supplied pitch value: the kernel compares the pitch against box dimensions only after the fact, or not at all, before copying data out of the underlying surface, so a crafted pitch can cause reads outside the true surface buffer during cursor snooping. The affected code is identified by commit 2ac863719e518ae1a8f328849e64ea26a222f079 as the branch point, with fixes landing in git.kernel.org stable commits db6fbc2b77849e3c3c2bc115ea9ac925c4625a0d, f6d9c8abdf06a9c7efa799532d66ed8d5a50734c, 76e5ddd7d9822c8c3492e0f50ba8978e093069ad, fcb137f6e7ed769f7ecad84364a33c451371b602 and 21bc51cb89ced74d6645a138cc2f21184bc75094. The vendor fix is a bounds check on the pitch taken from userspace before the copy, closing the out-of-bounds read. No CWE is assigned in the supplied data; the assessed impact is a confidentiality-oriented out-of-bounds read with a limited availability impact (C:H/I:N/A:L), not memory corruption with code execution.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local low-priv user triggers an out-of-bounds read, so AV:L/PR:L with C:H for memory disclosure; I:N since a read cannot corrupt data, and A:L for a possible kernel crash.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
4DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
drm/vmwgfx: validate pitch coming from userspace
Validate the pitch, alongside the box dimensions before trying to copy data from the underlying surface. Fixes possible out of bounds reads with cursor snooping.
Executive ViewAI
A high-severity vulnerability in the Linux kernel's vmwgfx driver could allow a local, low-privileged user to read out-of-bounds memory on VMware virtual machines. This affects only Linux guests using the paravirtual GPU driver, potentially exposing sensitive kernel data and undermining isolation between users; leadership should prioritize patching to maintain the security of virtualized workloads, though the low exploit likelihood reduces immediate urgency.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB