{"id":"CVE-2026-68446","title":"drm/vmwgfx: Validate vmw_surface_metadata::array_size","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: Validate vmw_surface_metadata::array_size\n\nThis field comes from userspace and should be validated against specific\nlimits depending on which Shader Model (…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 504901dbb0b565fcbe466b0c56f3131586df5afd < e949adf2d42678fb391a41db277e2fcb12090566","Linux >= 504901dbb0b565fcbe466b0c56f3131586df5afd < 0403cec2aff8037bc246cf9a0831eb169ddcd9df","Linux >= 504901dbb0b565fcbe466b0c56f3131586df5afd < aded8463466ede7a7fbd1bbf821756c67c83e89b","Linux >= 504901dbb0b565fcbe466b0c56f3131586df5afd < 5ff94e1279176b539d451e3e754fdcbd1a8d520a","Linux >= 504901dbb0b565fcbe466b0c56f3131586df5afd < 71779fe8bf403a9b3e28dc59229fa556db32d35d","Linux >= 504901dbb0b565fcbe466b0c56f3131586df5afd < b1379f0c42b88cb60b9f3757eb5d1e73ad460ed8","Linux >= 504901dbb0b565fcbe466b0c56f3131586df5afd < 6910ccaf41678f7761ba2e57d72b77d056320b4d","Linux >= 504901dbb0b565fcbe466b0c56f3131586df5afd < a4f55260f7f7d4dc4d0ee55063dfb0c457b77991","Linux 5.7"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T15:49:03.361891Z"},"published":"2026-08-12","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:53:13.812Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-68446","references":[{"url":"https://git.kernel.org/stable/c/e949adf2d42678fb391a41db277e2fcb12090566"},{"url":"https://git.kernel.org/stable/c/0403cec2aff8037bc246cf9a0831eb169ddcd9df"},{"url":"https://git.kernel.org/stable/c/aded8463466ede7a7fbd1bbf821756c67c83e89b"},{"url":"https://git.kernel.org/stable/c/5ff94e1279176b539d451e3e754fdcbd1a8d520a"},{"url":"https://git.kernel.org/stable/c/71779fe8bf403a9b3e28dc59229fa556db32d35d"},{"url":"https://git.kernel.org/stable/c/b1379f0c42b88cb60b9f3757eb5d1e73ad460ed8"},{"url":"https://git.kernel.org/stable/c/6910ccaf41678f7761ba2e57d72b77d056320b4d"},{"url":"https://git.kernel.org/stable/c/a4f55260f7f7d4dc4d0ee55063dfb0c457b77991"}],"tags":["cve.org"],"epss":0.0012,"epssPercentile":0.01715,"ingestedAt":"2026-10-16T17:24:46.868Z","slug":"CVE-2026-68446","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: Validate vmw_surface_metadata::array_size\n\nThis field comes from userspace and should be validated against specific\nlimits depending on which Shader Model (SM) is available.\n\n## Affected\n\n- `Linux >= 504901dbb0b565fcbe466b0c56f3131586df5afd < e949adf2d42678fb391a41db277e2fcb12090566`\n- `Linux >= 504901dbb0b565fcbe466b0c56f3131586df5afd < 0403cec2aff8037bc246cf9a0831eb169ddcd9df`\n- `Linux >= 504901dbb0b565fcbe466b0c56f3131586df5afd < aded8463466ede7a7fbd1bbf821756c67c83e89b`\n- `Linux >= 504901dbb0b565fcbe466b0c56f3131586df5afd < 5ff94e1279176b539d451e3e754fdcbd1a8d520a`\n- `Linux >= 504901dbb0b565fcbe466b0c56f3131586df5afd < 71779fe8bf403a9b3e28dc59229fa556db32d35d`\n- `Linux >= 504901dbb0b565fcbe466b0c56f3131586df5afd < b1379f0c42b88cb60b9f3757eb5d1e73ad460ed8`\n- `Linux >= 504901dbb0b565fcbe466b0c56f3131586df5afd < 6910ccaf41678f7761ba2e57d72b77d056320b4d`\n- `Linux >= 504901dbb0b565fcbe466b0c56f3131586df5afd < a4f55260f7f7d4dc4d0ee55063dfb0c457b77991`\n- `Linux 5.7`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}