---
cve: "CVE-2026-80701"
severity: "LOW"
cvss: 3.1
epss: "3.2%"
vendor: "Linux"
kev: false
exploited: false
published: "2026-08-28 08:16:55"
tags: [cve, security, low]
source: tsecurity.de CVE-Dossier
exported: "2026-09-04T01:06:43+02:00"
---

# CVE-2026-80701

> 3.1 LOW

## Beschreibung

In the Linux kernel, the following vulnerability has been resolved:

drm/vmwgfx: enforce cursor size limits for MOB cursors

vmw_cursor_plane_atomic_check() bounds cursor width and height only
on the legacy update path; the SVGA_CAP2_CURSOR_MOB path -- the
default on modern hosts -- accepts any size.  When the requested size
exceeds SVGA_REG_CURSOR_MAX_DIMENSION or SVGA_REG_MOB_MAX_SIZE,
vmw_cursor_mob_get() returns -EINVAL and leaves vps->cursor.mob NULL.
Its return value is then discarded in vmw_cursor_plane_prepare_fb(),
so the subsequent vmw_cursor_update_mob() calls
vmw_bo_map_and_cache(NULL) and oopses inside
vmw_bo_map_and_cache_size() on the tbo.base.size load.

Reachable from any DRM master via DRM_IOCTL_MODE_CURSOR2 with a
sufficiently large width or height (e.g. cursor_max_dim + 1).

Reject oversized cursors in atomic_check for both MOB-backed cursor
update types.  The MOB byte-size limit only applies to the
SVGA_CAP2_CURSOR_MOB path (vmw_cursor_mob_size() returns 0 for
GB_ONLY); compute the required MOB size in 64-bit to avoid overflow
when very large dimensions are requested.

In prepare_fb only call vmw_cursor_mob_get()/_map() for
VMW_CURSOR_UPDATE_MOB -- the GB_ONLY path uses bo->map.virtual
directly and would otherwise be silently downgraded to NONE on hosts
without SVGA_CAP2_CURSOR_MOB (where vmw_cursor_mob_get() always
returns -EINVAL).  Degrade the update to NONE if vmw_cursor_mob_get()
or vmw_cursor_mob_map() fails so the update path does not run with a
NULL backing MOB.

## Patch verfügbar (OSV)

- Kernel ≥ 6.18.44
- Kernel ≥ 7.1.8

## Referenzen

- <https://git.kernel.org/stable/c/1eb4f796695be39e0b5c4383350033ced9ade703>
- <https://git.kernel.org/stable/c/9109b7935b9c058b75348610ef8437c52f9020e3>
- <https://git.kernel.org/stable/c/d5ed8749168ad13c0dbaa8300f68d854b6076966>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-80701) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_