{"id":"CVE-2026-80888","title":"drm/vmwgfx: drop dma_buf reference on foreign-fd prime import","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: drop dma_buf reference on foreign-fd prime import\n\nttm_prime_fd_to_handle() returns -ENOSYS when the imported fd's\ndma_buf->ops do not match the ttm_object_…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 65981f7681abdf92b25942222b629b9c512d0705 < 1715901e7052cf90fbf04c8303e563a47e021278","Linux >= 65981f7681abdf92b25942222b629b9c512d0705 < c4fd91ee7228f56fbb4cf528757dc17ffefeb0ee","Linux >= 65981f7681abdf92b25942222b629b9c512d0705 < 619c3cfa88e09603a13d918f754808db2dda7057","Linux >= 65981f7681abdf92b25942222b629b9c512d0705 < c1c22fca0a0896a452a7cb92422d67babd65b4be","Linux >= 65981f7681abdf92b25942222b629b9c512d0705 < a1e972fa94c3a8069e022c67b9d97c7aa7b05293","Linux >= 65981f7681abdf92b25942222b629b9c512d0705 < a8434b145b1e467940334c58c00af241e9494c5f","Linux >= 65981f7681abdf92b25942222b629b9c512d0705 < 4df39eb99bb47d1f24d1952c23b21b10988356bf","Linux >= 65981f7681abdf92b25942222b629b9c512d0705 < f739416dc555fa205a785e5135d73fa39b26f35d","Linux 3.13"],"published":"2026-09-04","updated":"2026-09-14","sourceUpdated":"2026-09-14T11:58:52.563Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-80888","references":[{"url":"https://git.kernel.org/stable/c/1715901e7052cf90fbf04c8303e563a47e021278"},{"url":"https://git.kernel.org/stable/c/c4fd91ee7228f56fbb4cf528757dc17ffefeb0ee"},{"url":"https://git.kernel.org/stable/c/619c3cfa88e09603a13d918f754808db2dda7057"},{"url":"https://git.kernel.org/stable/c/c1c22fca0a0896a452a7cb92422d67babd65b4be"},{"url":"https://git.kernel.org/stable/c/a1e972fa94c3a8069e022c67b9d97c7aa7b05293"},{"url":"https://git.kernel.org/stable/c/a8434b145b1e467940334c58c00af241e9494c5f"},{"url":"https://git.kernel.org/stable/c/4df39eb99bb47d1f24d1952c23b21b10988356bf"},{"url":"https://git.kernel.org/stable/c/f739416dc555fa205a785e5135d73fa39b26f35d"}],"tags":["cve.org"],"epss":0.00177,"epssPercentile":0.07515,"ingestedAt":"2026-09-14T15:23:07.456Z","slug":"CVE-2026-80888","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: drop dma_buf reference on foreign-fd prime import\n\nttm_prime_fd_to_handle() returns -ENOSYS when the imported fd's\ndma_buf->ops do not match the ttm_object_device's ops, but does so\nwithout releasing the reference acquired by dma_buf_get().  Any\nunprivileged renderD client passing a non-vmwgfx prime fd through the\nDRM_VMW_GB_SURFACE_REF{,_EXT} path leaks one dma_buf reference per\ncall and indefinitely pins the foreign exporter's GEM resources.\n\nFunnel the error path through the existing dma_buf_put() so the\nreference is always dropped.\n\n## Affected\n\n- `Linux >= 65981f7681abdf92b25942222b629b9c512d0705 < 1715901e7052cf90fbf04c8303e563a47e021278`\n- `Linux >= 65981f7681abdf92b25942222b629b9c512d0705 < c4fd91ee7228f56fbb4cf528757dc17ffefeb0ee`\n- `Linux >= 65981f7681abdf92b25942222b629b9c512d0705 < 619c3cfa88e09603a13d918f754808db2dda7057`\n- `Linux >= 65981f7681abdf92b25942222b629b9c512d0705 < c1c22fca0a0896a452a7cb92422d67babd65b4be`\n- `Linux >= 65981f7681abdf92b25942222b629b9c512d0705 < a1e972fa94c3a8069e022c67b9d97c7aa7b05293`\n- `Linux >= 65981f7681abdf92b25942222b629b9c512d0705 < a8434b145b1e467940334c58c00af241e9494c5f`\n- `Linux >= 65981f7681abdf92b25942222b629b9c512d0705 < 4df39eb99bb47d1f24d1952c23b21b10988356bf`\n- `Linux >= 65981f7681abdf92b25942222b629b9c512d0705 < f739416dc555fa205a785e5135d73fa39b26f35d`\n- `Linux 3.13`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}