CVE-2026-80701

A moderate-severity denial of service flaw was found in the Linux kernel's drm/vmwgfx driver. The SVGA_CAP2_CURSOR_MOB cursor update path, which is the default on modern VMware hosts, does not validate cursor width and height against the SVGA_REG_CURSOR_MAX_DIMENSION or SVGA_REG_MOB_MAX_SIZE limits. A local attacker with DRM master privileges, such as a process controlling a graphical session, could request an oversized cursor through the DRM_IOCTL_MODE_CURSOR2 ioctl. This causes vmw_cursor_mob_get() to fail and leave the cursor MOB NULL; because that error return is discarded, the subsequent update path calls vmw_bo_map_and_cache() on the NULL pointer, resulting in a kernel oops and a system crash. Only availability is impacted; there is no effect on confidentiality or integrity. Red Hat rated this flaw Moderate (CVSS 3.1: 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), reflecting a local, low-privilege denial of service.

This flaw affects Red Hat Enterprise Linux 9 (kernel and kernel-rt in the rhel-9.8.z, rhel-9.9, and rhel-9.10 streams), Red Hat Enterprise Linux 10 (kernel in the rhel-10.2.z, rhel-10.3, and rhel-10.4 streams), and Red Hat In-Vehicle OS 2 (kernel and kernel-ivos-qualcomm), where the vulnerable code was introduced through merges of upstream DRM changes from v6.16. Earlier releases and streams (RHEL 6, 7, and 8, and the rhel-9.2.0.z, rhel-9.4.z, rhel-9.6.z, and rhel-10.0.z streams) are not affected because the vulnerable code is not present. Because the impact is limited to a local kernel crash on systems using the vmwgfx driver on VMware hosts, fixes for the affected streams are currently deferred to a future update; the residual risk remains a local denial of service with no confidentiality or integrity impact.