---
id: CVE-2026-99002
title: 'drm/vmwgfx: validate pitch coming from userspace'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/vmwgfx: validate pitch coming from userspace

  Validate the pitch, alongside the box dimensions before trying
  to copy data from the underlying surface. Fixes possibl…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 2ac863719e518ae1a8f328849e64ea26a222f079 <
    db6fbc2b77849e3c3c2bc115ea9ac925c4625a0d
  - >-
    Linux >= 2ac863719e518ae1a8f328849e64ea26a222f079 <
    f6d9c8abdf06a9c7efa799532d66ed8d5a50734c
  - >-
    Linux >= 2ac863719e518ae1a8f328849e64ea26a222f079 <
    76e5ddd7d9822c8c3492e0f50ba8978e093069ad
  - >-
    Linux >= 2ac863719e518ae1a8f328849e64ea26a222f079 <
    fcb137f6e7ed769f7ecad84364a33c451371b602
  - >-
    Linux >= 2ac863719e518ae1a8f328849e64ea26a222f079 <
    21bc51cb89ced74d6645a138cc2f21184bc75094
  - Linux 3.2
published: '2026-10-23'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T12:20:22.763Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-99002'
references:
  - url: 'https://git.kernel.org/stable/c/db6fbc2b77849e3c3c2bc115ea9ac925c4625a0d'
  - url: 'https://git.kernel.org/stable/c/f6d9c8abdf06a9c7efa799532d66ed8d5a50734c'
  - url: 'https://git.kernel.org/stable/c/76e5ddd7d9822c8c3492e0f50ba8978e093069ad'
  - url: 'https://git.kernel.org/stable/c/fcb137f6e7ed769f7ecad84364a33c451371b602'
  - url: 'https://git.kernel.org/stable/c/21bc51cb89ced74d6645a138cc2f21184bc75094'
tags:
  - cve.org
ingestedAt: '2026-10-23T13:24:55.542Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/vmwgfx: validate pitch coming from userspace

Validate the pitch, alongside the box dimensions before trying
to copy data from the underlying surface. Fixes possible
out of bounds reads with cursor snooping.

## Affected

- `Linux >= 2ac863719e518ae1a8f328849e64ea26a222f079 < db6fbc2b77849e3c3c2bc115ea9ac925c4625a0d`
- `Linux >= 2ac863719e518ae1a8f328849e64ea26a222f079 < f6d9c8abdf06a9c7efa799532d66ed8d5a50734c`
- `Linux >= 2ac863719e518ae1a8f328849e64ea26a222f079 < 76e5ddd7d9822c8c3492e0f50ba8978e093069ad`
- `Linux >= 2ac863719e518ae1a8f328849e64ea26a222f079 < fcb137f6e7ed769f7ecad84364a33c451371b602`
- `Linux >= 2ac863719e518ae1a8f328849e64ea26a222f079 < 21bc51cb89ced74d6645a138cc2f21184bc75094`
- `Linux 3.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.