---
id: CVE-2026-68446
title: 'drm/vmwgfx: Validate vmw_surface_metadata::array_size'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/vmwgfx: Validate vmw_surface_metadata::array_size

  This field comes from userspace and should be validated against specific
  limits depending on which Shader Model (…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 504901dbb0b565fcbe466b0c56f3131586df5afd <
    e949adf2d42678fb391a41db277e2fcb12090566
  - >-
    Linux >= 504901dbb0b565fcbe466b0c56f3131586df5afd <
    0403cec2aff8037bc246cf9a0831eb169ddcd9df
  - >-
    Linux >= 504901dbb0b565fcbe466b0c56f3131586df5afd <
    aded8463466ede7a7fbd1bbf821756c67c83e89b
  - >-
    Linux >= 504901dbb0b565fcbe466b0c56f3131586df5afd <
    5ff94e1279176b539d451e3e754fdcbd1a8d520a
  - >-
    Linux >= 504901dbb0b565fcbe466b0c56f3131586df5afd <
    71779fe8bf403a9b3e28dc59229fa556db32d35d
  - >-
    Linux >= 504901dbb0b565fcbe466b0c56f3131586df5afd <
    b1379f0c42b88cb60b9f3757eb5d1e73ad460ed8
  - >-
    Linux >= 504901dbb0b565fcbe466b0c56f3131586df5afd <
    6910ccaf41678f7761ba2e57d72b77d056320b4d
  - >-
    Linux >= 504901dbb0b565fcbe466b0c56f3131586df5afd <
    a4f55260f7f7d4dc4d0ee55063dfb0c457b77991
  - Linux 5.7
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:49:03.361891Z'
published: '2026-08-12'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:53:13.812Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-68446'
references:
  - url: 'https://git.kernel.org/stable/c/e949adf2d42678fb391a41db277e2fcb12090566'
  - url: 'https://git.kernel.org/stable/c/0403cec2aff8037bc246cf9a0831eb169ddcd9df'
  - url: 'https://git.kernel.org/stable/c/aded8463466ede7a7fbd1bbf821756c67c83e89b'
  - url: 'https://git.kernel.org/stable/c/5ff94e1279176b539d451e3e754fdcbd1a8d520a'
  - url: 'https://git.kernel.org/stable/c/71779fe8bf403a9b3e28dc59229fa556db32d35d'
  - url: 'https://git.kernel.org/stable/c/b1379f0c42b88cb60b9f3757eb5d1e73ad460ed8'
  - url: 'https://git.kernel.org/stable/c/6910ccaf41678f7761ba2e57d72b77d056320b4d'
  - url: 'https://git.kernel.org/stable/c/a4f55260f7f7d4dc4d0ee55063dfb0c457b77991'
tags:
  - cve.org
epss: 0.0012
epssPercentile: 0.01715
ingestedAt: '2026-10-16T17:24:46.868Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/vmwgfx: Validate vmw_surface_metadata::array_size

This field comes from userspace and should be validated against specific
limits depending on which Shader Model (SM) is available.

## Affected

- `Linux >= 504901dbb0b565fcbe466b0c56f3131586df5afd < e949adf2d42678fb391a41db277e2fcb12090566`
- `Linux >= 504901dbb0b565fcbe466b0c56f3131586df5afd < 0403cec2aff8037bc246cf9a0831eb169ddcd9df`
- `Linux >= 504901dbb0b565fcbe466b0c56f3131586df5afd < aded8463466ede7a7fbd1bbf821756c67c83e89b`
- `Linux >= 504901dbb0b565fcbe466b0c56f3131586df5afd < 5ff94e1279176b539d451e3e754fdcbd1a8d520a`
- `Linux >= 504901dbb0b565fcbe466b0c56f3131586df5afd < 71779fe8bf403a9b3e28dc59229fa556db32d35d`
- `Linux >= 504901dbb0b565fcbe466b0c56f3131586df5afd < b1379f0c42b88cb60b9f3757eb5d1e73ad460ed8`
- `Linux >= 504901dbb0b565fcbe466b0c56f3131586df5afd < 6910ccaf41678f7761ba2e57d72b77d056320b4d`
- `Linux >= 504901dbb0b565fcbe466b0c56f3131586df5afd < a4f55260f7f7d4dc4d0ee55063dfb0c457b77991`
- `Linux 5.7`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.