---
cve: "CVE-2026-80702"
severity: "LOW"
cvss: 3.1
epss: "2.6%"
vendor: "Linux"
kev: false
exploited: false
published: "2026-08-28 08:16:55"
tags: [cve, security, low]
source: tsecurity.de CVE-Dossier
exported: "2026-09-03T00:55:36+02:00"
---

# CVE-2026-80702

> 3.1 LOW

## Beschreibung

In the Linux kernel, the following vulnerability has been resolved:

drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size

Two sites in vmwgfx_resource.c assign boolean literals to
res->guest_memory_size, which is an unsigned long allocation-size
field; the intended target is the adjacent res->guest_memory_dirty
bitfield.  After the assignments the field holds 0 or 1 instead of
the resource's MOB allocation size:

  - vmw_resource_release()       writes 0 (false), and
  - vmw_resource_unbind_list()   writes 1 (true).

Subsequent revalidation paths read guest_memory_size when computing
the dirty page range (vmw_bo_dirty_transfer_to_res()) and the buffer
allocation size (vmw_resource_buf_alloc()), producing zero-length
walks or wrap-around ranges that read or write past the MOB bitmap.
The dirty-tracking intent of the original code (mark the resource as
dirtied since the last sync) is also lost, since guest_memory_dirty
is never updated.

Rename both assignments to guest_memory_dirty.

## Patch verfügbar (OSV)

- Kernel ≥ 6.6.151
- Kernel ≥ 6.12.103
- Kernel ≥ 6.18.44
- Kernel ≥ 7.1.8

## Referenzen

- <https://git.kernel.org/stable/c/21bbe38faee4a195d33a93e3908e307807f7745d>
- <https://git.kernel.org/stable/c/9d6cbb76fe9cd760351f6b0b20f1bf788eab8fa6>
- <https://git.kernel.org/stable/c/282f261cb035e5f01a486f76d356b7e9dbfba73f>
- <https://git.kernel.org/stable/c/3b2bb16a5b622867140d69925db411ac8ecb3b2b>
- <https://git.kernel.org/stable/c/83195b778f2d109a3a4f3ffaba4dce7e4cdb58aa>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-80702) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_