In the Linux kernel, the following vulnerability has been resolved:
drm/vmwgfx: use check_add_overflow for shader size+offset bound
vmw_shader_define() validates the user-supplied shader window against its backing buffer with
(u64)buffer->tbo.base.size < (u64)size + (u64)offset
drm_vmw_shader_create_arg::offset is __u64 in the uapi; when it is near U64_MAX the unsigned addition wraps and the resulting tiny value passes the check. The unbounded offset is then stored in res->guest_memory_offset and forwarded to host SVGA shader-create commands.
Use check_add_overflow() to detect the wrap and compare the resulting endpoint against the buffer size.
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-rt-debug-modulesUpgrade kernel-debugUpgrade kernel-headersUpgrade kernel-rt-debug-develUpgrade kernel-modules-extraUpgrade kernel-64k-modulesUpgrade kernel-64k-debug-coreUpgrade kernel-rt-debug-coreUpgrade kernel-zfcpdump-modules-extraUpgrade perfUpgrade kernel-debug-develUpgrade kernel-coreUpgrade kernel-64k-modules-coreUpgrade kernel-rt-develUpgrade kernel-cross-headersUpgrade kernel-rt-debugUpgrade kernel-rt-modules-extraUpgrade kernel-64k-debug-modulesUpgrade kernel-64kUpgrade kernelUpgrade kernel-develUpgrade kernel-rt-coreUpgrade kernel-zfcpdump-develUpgrade python3-perfUpgrade kernel-modulesUpgrade kernel-debug-coreUpgrade kernel-abi-stablelistsUpgrade kernel-64k-modules-extraUpgrade kernel-64k-debugUpgrade kernel-tools-libsUpgrade kernel-rtUpgrade kernel-64k-debug-modules-extraUpgrade kernel-tools-libs-develUpgrade kernel-64k-coreUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-modulesUpgrade kernel-docUpgrade kernel-debug-modules-extraUpgrade kernel-debug-modulesUpgrade kernel-64k-debug-modules-coreUpgrade bpftoolUpgrade kernel-zfcpdumpUpgrade kernel-toolsUpgrade kernel-debug-modules-coreUpgrade kernel-rt-debug-modules-extraUpgrade kernel-zfcpdump-core | Oct 14, 2026 | Oct 14, 2026 |
| Debian | — | Upgrade linuxUpgrade linux-6.12 | Sep 21, 2026 | Sep 4, 2026 |
| Oracle_linux | — | Upgrade kernel | Oct 22, 2026 | Sep 4, 2026 |
| Redhat_linux | — | No solution existsUpgrade kernel-rtUpgrade kernel | Oct 8, 2026 | Sep 4, 2026 |
| Rocky_linux | — | Upgrade kernel-rt-debug-modulesUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-debug-modules-extraUpgrade kernel-rt-debug-modules-coreUpgrade kernel-devel-matchedUpgrade kernel-modules-coreUpgrade rvUpgrade kernel-debug-devel-matchedUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-debug-modulesUpgrade bpftoolUpgrade kernel-rt-debug-debuginfoUpgrade kernel-rt-coreUpgrade kernel-zfcpdump-devel-matchedUpgrade libperf-debuginfoUpgrade kernel-rt-debug-coreUpgrade python3-perfUpgrade kernel-tools-libsUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-rt-develUpgrade python3-perf-debuginfoUpgrade kernel-zfcpdump-coreUpgrade kernel-rt-modules-extraUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-rt-debugUpgrade kernel-rt-kvmUpgrade kernel-tools-libs-develUpgrade kernelUpgrade kernel-debug-modules-coreUpgrade kernel-coreUpgrade kernel-zfcpdump-modulesUpgrade kernel-modulesUpgrade kernel-modules-extraUpgrade kernel-rtUpgrade kernel-debug-uki-virtUpgrade kernel-debug-debuginfoUpgrade kernel-debug-coreUpgrade kernel-toolsUpgrade bpftool-debuginfoUpgrade kernel-rt-debug-modules-extraUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rt-debug-kvmUpgrade kernel-develUpgrade kernel-debugUpgrade perf-debuginfoUpgrade libperfUpgrade kernel-rt-debug-develUpgrade perfUpgrade kernel-rt-modules-coreUpgrade kernel-debuginfo-common-s390xUpgrade kernel-debuginfoUpgrade rtlaUpgrade kernel-zfcpdump-develUpgrade kernel-debug-develUpgrade kernel-tools-debuginfoUpgrade kernel-uki-virt-addonsUpgrade kernel-rt-modulesUpgrade kernel-zfcpdumpUpgrade kernel-rt-debuginfoUpgrade kernel-uki-virt | Oct 16, 2026 | Oct 14, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Sep 21, 2026 | Sep 4, 2026 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub