{"id":"CVE-2026-80702","title":"drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size\n\nTwo sites in vmwgfx_resource.c assign boolean literals to\nres->guest_memory_size, which is an unsigned lo…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 668b206601c5f5063e03b76784a0d3024fa2b249 < 21bbe38faee4a195d33a93e3908e307807f7745d","Linux >= 668b206601c5f5063e03b76784a0d3024fa2b249 < 9d6cbb76fe9cd760351f6b0b20f1bf788eab8fa6","Linux >= 668b206601c5f5063e03b76784a0d3024fa2b249 < 282f261cb035e5f01a486f76d356b7e9dbfba73f","Linux >= 668b206601c5f5063e03b76784a0d3024fa2b249 < 3b2bb16a5b622867140d69925db411ac8ecb3b2b","Linux >= 668b206601c5f5063e03b76784a0d3024fa2b249 < 83195b778f2d109a3a4f3ffaba4dce7e4cdb58aa","Linux 6.4"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T19:20:19.394776Z"},"published":"2026-08-28","updated":"2026-10-16","sourceUpdated":"2026-10-16T19:26:34.045Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-80702","references":[{"url":"https://git.kernel.org/stable/c/21bbe38faee4a195d33a93e3908e307807f7745d"},{"url":"https://git.kernel.org/stable/c/9d6cbb76fe9cd760351f6b0b20f1bf788eab8fa6"},{"url":"https://git.kernel.org/stable/c/282f261cb035e5f01a486f76d356b7e9dbfba73f"},{"url":"https://git.kernel.org/stable/c/3b2bb16a5b622867140d69925db411ac8ecb3b2b"},{"url":"https://git.kernel.org/stable/c/83195b778f2d109a3a4f3ffaba4dce7e4cdb58aa"}],"tags":["cve.org"],"epss":0.00129,"epssPercentile":0.02216,"ingestedAt":"2026-10-16T19:46:24.304Z","slug":"CVE-2026-80702","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size\n\nTwo sites in vmwgfx_resource.c assign boolean literals to\nres->guest_memory_size, which is an unsigned long allocation-size\nfield; the intended target is the adjacent res->guest_memory_dirty\nbitfield.  After the assignments the field holds 0 or 1 instead of\nthe resource's MOB allocation size:\n\n  - vmw_resource_release()       writes 0 (false), and\n  - vmw_resource_unbind_list()   writes 1 (true).\n\nSubsequent revalidation paths read guest_memory_size when computing\nthe dirty page range (vmw_bo_dirty_transfer_to_res()) and the buffer\nallocation size (vmw_resource_buf_alloc()), producing zero-length\nwalks or wrap-around ranges that read or write past the MOB bitmap.\nThe dirty-tracking intent of the original code (mark the resource as\ndirtied since the last sync) is also lost, since guest_memory_dirty\nis never updated.\n\nRename both assignments to guest_memory_dirty.\n\n## Affected\n\n- `Linux >= 668b206601c5f5063e03b76784a0d3024fa2b249 < 21bbe38faee4a195d33a93e3908e307807f7745d`\n- `Linux >= 668b206601c5f5063e03b76784a0d3024fa2b249 < 9d6cbb76fe9cd760351f6b0b20f1bf788eab8fa6`\n- `Linux >= 668b206601c5f5063e03b76784a0d3024fa2b249 < 282f261cb035e5f01a486f76d356b7e9dbfba73f`\n- `Linux >= 668b206601c5f5063e03b76784a0d3024fa2b249 < 3b2bb16a5b622867140d69925db411ac8ecb3b2b`\n- `Linux >= 668b206601c5f5063e03b76784a0d3024fa2b249 < 83195b778f2d109a3a4f3ffaba4dce7e4cdb58aa`\n- `Linux 6.4`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}