---
id: CVE-2026-80702
title: 'drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size

  Two sites in vmwgfx_resource.c assign boolean literals to
  res->guest_memory_size, which is an unsigned lo…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 668b206601c5f5063e03b76784a0d3024fa2b249 <
    21bbe38faee4a195d33a93e3908e307807f7745d
  - >-
    Linux >= 668b206601c5f5063e03b76784a0d3024fa2b249 <
    9d6cbb76fe9cd760351f6b0b20f1bf788eab8fa6
  - >-
    Linux >= 668b206601c5f5063e03b76784a0d3024fa2b249 <
    282f261cb035e5f01a486f76d356b7e9dbfba73f
  - >-
    Linux >= 668b206601c5f5063e03b76784a0d3024fa2b249 <
    3b2bb16a5b622867140d69925db411ac8ecb3b2b
  - >-
    Linux >= 668b206601c5f5063e03b76784a0d3024fa2b249 <
    83195b778f2d109a3a4f3ffaba4dce7e4cdb58aa
  - Linux 6.4
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T19:20:19.394776Z'
published: '2026-08-28'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T19:26:34.045Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-80702'
references:
  - url: 'https://git.kernel.org/stable/c/21bbe38faee4a195d33a93e3908e307807f7745d'
  - url: 'https://git.kernel.org/stable/c/9d6cbb76fe9cd760351f6b0b20f1bf788eab8fa6'
  - url: 'https://git.kernel.org/stable/c/282f261cb035e5f01a486f76d356b7e9dbfba73f'
  - url: 'https://git.kernel.org/stable/c/3b2bb16a5b622867140d69925db411ac8ecb3b2b'
  - url: 'https://git.kernel.org/stable/c/83195b778f2d109a3a4f3ffaba4dce7e4cdb58aa'
tags:
  - cve.org
epss: 0.00129
epssPercentile: 0.02216
ingestedAt: '2026-10-16T19:46:24.304Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size

Two sites in vmwgfx_resource.c assign boolean literals to
res->guest_memory_size, which is an unsigned long allocation-size
field; the intended target is the adjacent res->guest_memory_dirty
bitfield.  After the assignments the field holds 0 or 1 instead of
the resource's MOB allocation size:

  - vmw_resource_release()       writes 0 (false), and
  - vmw_resource_unbind_list()   writes 1 (true).

Subsequent revalidation paths read guest_memory_size when computing
the dirty page range (vmw_bo_dirty_transfer_to_res()) and the buffer
allocation size (vmw_resource_buf_alloc()), producing zero-length
walks or wrap-around ranges that read or write past the MOB bitmap.
The dirty-tracking intent of the original code (mark the resource as
dirtied since the last sync) is also lost, since guest_memory_dirty
is never updated.

Rename both assignments to guest_memory_dirty.

## Affected

- `Linux >= 668b206601c5f5063e03b76784a0d3024fa2b249 < 21bbe38faee4a195d33a93e3908e307807f7745d`
- `Linux >= 668b206601c5f5063e03b76784a0d3024fa2b249 < 9d6cbb76fe9cd760351f6b0b20f1bf788eab8fa6`
- `Linux >= 668b206601c5f5063e03b76784a0d3024fa2b249 < 282f261cb035e5f01a486f76d356b7e9dbfba73f`
- `Linux >= 668b206601c5f5063e03b76784a0d3024fa2b249 < 3b2bb16a5b622867140d69925db411ac8ecb3b2b`
- `Linux >= 668b206601c5f5063e03b76784a0d3024fa2b249 < 83195b778f2d109a3a4f3ffaba4dce7e4cdb58aa`
- `Linux 6.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.