Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate external BO copy bounds for both stride paths… (CVE-2026-80700)

The vulnerability in the Linux kernel drm/vmwgfx driver (CVE-2026-80700) arises from insufficient validation of offsets, strides, and heights in the vmw_external_bo_copy() function, which operates on imported dma-buf vmaps. Specifically, the equal-stride memcpy() path clamps bounds after subtracting offsets, which can wrap around if offsets exceed buffer sizes, causing memcpy() to read or write beyond the buffer. The non-equal-stride path lacks any bounds checking, allowing out-of-bounds access through a loop that calculates memory addresses without proper validation. These offsets and strides are derived from plane state configurations, meaning a malicious atomic commit on an imported framebuffer can exploit this. The fix involves validating copy endpoints using overflow checks and rejecting unsafe stride values.

Successful exploitation could lead to out-of-bounds memory reads or writes in kernel space, potentially causing system crashes, data corruption, or privilege escalation. The CVSS score of 7.8 reflects high impact on confidentiality, integrity, and availability. However, exploitation requires local privileges with low complexity and no user interaction.

A fix has been implemented in the Linux kernel to validate external BO copy bounds properly and reject unsafe stride values. Users should apply the official kernel updates that include this patch. Since this is not a cloud service, remediation depends on applying the vendor's kernel patches. Patch status is not explicitly provided here; check the vendor advisory or Linux kernel mailing lists for the official fixed versions and update accordingly.