---
id: CVE-2026-80888
title: 'drm/vmwgfx: drop dma_buf reference on foreign-fd prime import'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/vmwgfx: drop dma_buf reference on foreign-fd prime import

  ttm_prime_fd_to_handle() returns -ENOSYS when the imported fd's
  dma_buf->ops do not match the ttm_object_…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 65981f7681abdf92b25942222b629b9c512d0705 <
    1715901e7052cf90fbf04c8303e563a47e021278
  - >-
    Linux >= 65981f7681abdf92b25942222b629b9c512d0705 <
    c4fd91ee7228f56fbb4cf528757dc17ffefeb0ee
  - >-
    Linux >= 65981f7681abdf92b25942222b629b9c512d0705 <
    619c3cfa88e09603a13d918f754808db2dda7057
  - >-
    Linux >= 65981f7681abdf92b25942222b629b9c512d0705 <
    c1c22fca0a0896a452a7cb92422d67babd65b4be
  - >-
    Linux >= 65981f7681abdf92b25942222b629b9c512d0705 <
    a1e972fa94c3a8069e022c67b9d97c7aa7b05293
  - >-
    Linux >= 65981f7681abdf92b25942222b629b9c512d0705 <
    a8434b145b1e467940334c58c00af241e9494c5f
  - >-
    Linux >= 65981f7681abdf92b25942222b629b9c512d0705 <
    4df39eb99bb47d1f24d1952c23b21b10988356bf
  - >-
    Linux >= 65981f7681abdf92b25942222b629b9c512d0705 <
    f739416dc555fa205a785e5135d73fa39b26f35d
  - Linux 3.13
published: '2026-09-04'
updated: '2026-09-14'
sourceUpdated: '2026-09-14T11:58:52.563Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-80888'
references:
  - url: 'https://git.kernel.org/stable/c/1715901e7052cf90fbf04c8303e563a47e021278'
  - url: 'https://git.kernel.org/stable/c/c4fd91ee7228f56fbb4cf528757dc17ffefeb0ee'
  - url: 'https://git.kernel.org/stable/c/619c3cfa88e09603a13d918f754808db2dda7057'
  - url: 'https://git.kernel.org/stable/c/c1c22fca0a0896a452a7cb92422d67babd65b4be'
  - url: 'https://git.kernel.org/stable/c/a1e972fa94c3a8069e022c67b9d97c7aa7b05293'
  - url: 'https://git.kernel.org/stable/c/a8434b145b1e467940334c58c00af241e9494c5f'
  - url: 'https://git.kernel.org/stable/c/4df39eb99bb47d1f24d1952c23b21b10988356bf'
  - url: 'https://git.kernel.org/stable/c/f739416dc555fa205a785e5135d73fa39b26f35d'
tags:
  - cve.org
epss: 0.00177
epssPercentile: 0.07527
ingestedAt: '2026-09-14T15:23:07.456Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/vmwgfx: drop dma_buf reference on foreign-fd prime import

ttm_prime_fd_to_handle() returns -ENOSYS when the imported fd's
dma_buf->ops do not match the ttm_object_device's ops, but does so
without releasing the reference acquired by dma_buf_get().  Any
unprivileged renderD client passing a non-vmwgfx prime fd through the
DRM_VMW_GB_SURFACE_REF{,_EXT} path leaks one dma_buf reference per
call and indefinitely pins the foreign exporter's GEM resources.

Funnel the error path through the existing dma_buf_put() so the
reference is always dropped.

## Affected

- `Linux >= 65981f7681abdf92b25942222b629b9c512d0705 < 1715901e7052cf90fbf04c8303e563a47e021278`
- `Linux >= 65981f7681abdf92b25942222b629b9c512d0705 < c4fd91ee7228f56fbb4cf528757dc17ffefeb0ee`
- `Linux >= 65981f7681abdf92b25942222b629b9c512d0705 < 619c3cfa88e09603a13d918f754808db2dda7057`
- `Linux >= 65981f7681abdf92b25942222b629b9c512d0705 < c1c22fca0a0896a452a7cb92422d67babd65b4be`
- `Linux >= 65981f7681abdf92b25942222b629b9c512d0705 < a1e972fa94c3a8069e022c67b9d97c7aa7b05293`
- `Linux >= 65981f7681abdf92b25942222b629b9c512d0705 < a8434b145b1e467940334c58c00af241e9494c5f`
- `Linux >= 65981f7681abdf92b25942222b629b9c512d0705 < 4df39eb99bb47d1f24d1952c23b21b10988356bf`
- `Linux >= 65981f7681abdf92b25942222b629b9c512d0705 < f739416dc555fa205a785e5135d73fa39b26f35d`
- `Linux 3.13`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.