---
id: CVE-2026-80700
title: 'drm/vmwgfx: validate external BO copy bounds for both stride paths'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/vmwgfx: validate external BO copy bounds for both stride paths

  vmw_external_bo_copy() trusts caller-supplied offsets, strides, and
  heights and operates on imported…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 9a9716bbbf3dd6b6cbefba3abcc89af8b72631f4 <
    4e0f669e2951b742239c6fe847fcc406fe78748d
  - >-
    Linux >= 50f1199250912568606b3778dc56646c10cb7b04 <
    e7b25a6011781ebfdbc458552cae6d4156732771
  - >-
    Linux >= 50f1199250912568606b3778dc56646c10cb7b04 <
    042ca38779554687fc32b66a28328e0d9a36c58f
  - >-
    Linux >= 50f1199250912568606b3778dc56646c10cb7b04 <
    5e4a2d15637a906cbd9bc98e0bf969f5f713e344
  - >-
    Linux >= 50f1199250912568606b3778dc56646c10cb7b04 <
    706c93c5813caabbb0d0a576c017d15aeec2c113
  - Linux 5c12391ee1ab59cb2f3be3f1f5e6d0fc0c2dc854
  - Linux >= 6.6.49 < 6.6.151
  - Linux >= 6.10.8 < 6.11
  - Linux 6.11
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T19:20:14.904770Z'
published: '2026-08-28'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T19:26:33.894Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-80700'
references:
  - url: 'https://git.kernel.org/stable/c/4e0f669e2951b742239c6fe847fcc406fe78748d'
  - url: 'https://git.kernel.org/stable/c/e7b25a6011781ebfdbc458552cae6d4156732771'
  - url: 'https://git.kernel.org/stable/c/042ca38779554687fc32b66a28328e0d9a36c58f'
  - url: 'https://git.kernel.org/stable/c/5e4a2d15637a906cbd9bc98e0bf969f5f713e344'
  - url: 'https://git.kernel.org/stable/c/706c93c5813caabbb0d0a576c017d15aeec2c113'
tags:
  - cve.org
epss: 0.00129
epssPercentile: 0.02257
ingestedAt: '2026-10-16T19:46:24.306Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/vmwgfx: validate external BO copy bounds for both stride paths

vmw_external_bo_copy() trusts caller-supplied offsets, strides, and
heights and operates on imported dma-buf vmaps:

  - The equal-stride memcpy() bound was clamped after subtracting the
    offsets from dst_size and src_size; an offset larger than the BO
    size wraps the unsigned subtraction to a huge value and the
    resulting memcpy() runs off the end of the vmap.  dst_stride *
    height is also a u32 multiplication that can overflow.
  - The non-equal-stride row-by-row path had no bound at all.  The
    loop touches bytes through offset + (height - 1) * stride +
    width_in_bytes, with only a WARN_ON(dst_stride < width_in_bytes),
    and could likewise step past the end of either mapping.

The offsets and strides are derived from STDU/SOU plane state, so a
configured CRTC submitting a crafted atomic commit on an imported
framebuffer can reach this path.

Validate the exact row-copy endpoint against each BO's size up front
using check_mul_overflow() and check_add_overflow().  Use the bulk
memcpy() path only when width_in_bytes covers the whole stride;
otherwise copy one row at a time so partial-row updates near the bottom
of a framebuffer remain valid.  Also reject zero strides and stride <
width_in_bytes, both of which the row-by-row path cannot represent
safely.

## Affected

- `Linux >= 9a9716bbbf3dd6b6cbefba3abcc89af8b72631f4 < 4e0f669e2951b742239c6fe847fcc406fe78748d`
- `Linux >= 50f1199250912568606b3778dc56646c10cb7b04 < e7b25a6011781ebfdbc458552cae6d4156732771`
- `Linux >= 50f1199250912568606b3778dc56646c10cb7b04 < 042ca38779554687fc32b66a28328e0d9a36c58f`
- `Linux >= 50f1199250912568606b3778dc56646c10cb7b04 < 5e4a2d15637a906cbd9bc98e0bf969f5f713e344`
- `Linux >= 50f1199250912568606b3778dc56646c10cb7b04 < 706c93c5813caabbb0d0a576c017d15aeec2c113`
- `Linux 5c12391ee1ab59cb2f3be3f1f5e6d0fc0c2dc854`
- `Linux >= 6.6.49 < 6.6.151`
- `Linux >= 6.10.8 < 6.11`
- `Linux 6.11`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.