{"id":"CVE-2026-99002","title":"drm/vmwgfx: validate pitch coming from userspace","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: validate pitch coming from userspace\n\nValidate the pitch, alongside the box dimensions before trying\nto copy data from the underlying surface. Fixes possibl…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 2ac863719e518ae1a8f328849e64ea26a222f079 < db6fbc2b77849e3c3c2bc115ea9ac925c4625a0d","Linux >= 2ac863719e518ae1a8f328849e64ea26a222f079 < f6d9c8abdf06a9c7efa799532d66ed8d5a50734c","Linux >= 2ac863719e518ae1a8f328849e64ea26a222f079 < 76e5ddd7d9822c8c3492e0f50ba8978e093069ad","Linux >= 2ac863719e518ae1a8f328849e64ea26a222f079 < fcb137f6e7ed769f7ecad84364a33c451371b602","Linux >= 2ac863719e518ae1a8f328849e64ea26a222f079 < 21bc51cb89ced74d6645a138cc2f21184bc75094","Linux 3.2"],"published":"2026-10-23","updated":"2026-10-23","sourceUpdated":"2026-10-23T12:20:22.763Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-99002","references":[{"url":"https://git.kernel.org/stable/c/db6fbc2b77849e3c3c2bc115ea9ac925c4625a0d"},{"url":"https://git.kernel.org/stable/c/f6d9c8abdf06a9c7efa799532d66ed8d5a50734c"},{"url":"https://git.kernel.org/stable/c/76e5ddd7d9822c8c3492e0f50ba8978e093069ad"},{"url":"https://git.kernel.org/stable/c/fcb137f6e7ed769f7ecad84364a33c451371b602"},{"url":"https://git.kernel.org/stable/c/21bc51cb89ced74d6645a138cc2f21184bc75094"}],"tags":["cve.org"],"ingestedAt":"2026-10-23T13:24:55.542Z","slug":"CVE-2026-99002","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: validate pitch coming from userspace\n\nValidate the pitch, alongside the box dimensions before trying\nto copy data from the underlying surface. Fixes possible\nout of bounds reads with cursor snooping.\n\n## Affected\n\n- `Linux >= 2ac863719e518ae1a8f328849e64ea26a222f079 < db6fbc2b77849e3c3c2bc115ea9ac925c4625a0d`\n- `Linux >= 2ac863719e518ae1a8f328849e64ea26a222f079 < f6d9c8abdf06a9c7efa799532d66ed8d5a50734c`\n- `Linux >= 2ac863719e518ae1a8f328849e64ea26a222f079 < 76e5ddd7d9822c8c3492e0f50ba8978e093069ad`\n- `Linux >= 2ac863719e518ae1a8f328849e64ea26a222f079 < fcb137f6e7ed769f7ecad84364a33c451371b602`\n- `Linux >= 2ac863719e518ae1a8f328849e64ea26a222f079 < 21bc51cb89ced74d6645a138cc2f21184bc75094`\n- `Linux 3.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}