In the Linux kernel, the following vulnerability has been resolved:
drm/vmwgfx: use check_add_overflow for shader size+offset bound
vmw_shader_define() validates the user-supplied shader window against its backing buffer with
(u64)buffer->tbo.base.size < (u64)size + (u64)offset
drm_vmw_shader_create_arg::offset is __u64 in the uapi; when it is near U64_MAX the unsigned addition wraps and the resulting tiny value passes the check. The unbounded offset is then stored in res->guest_memory_offset and forwarded to host SVGA shader-create commands.
Use check_add_overflow() to detect the wrap and compare the resulting endpoint against the buffer size.
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade bpftoolUpgrade kernel-debug-modules-extraUpgrade kernel-tools-libsUpgrade kernel-64k-coreUpgrade kernel-64k-debug-modules-extraUpgrade kernel-docUpgrade kernel-abi-stablelistsUpgrade kernel-64k-debugUpgrade kernel-64k-modules-extraUpgrade kernel-rt-modulesUpgrade kernel-debug-modules-coreUpgrade kernel-zfcpdumpUpgrade kernel-toolsUpgrade kernel-rt-debug-modules-extraUpgrade kernel-zfcpdump-coreUpgrade kernel-debug-modulesUpgrade kernel-zfcpdump-modulesUpgrade kernel-64k-debug-modules-coreUpgrade kernel-rtUpgrade kernel-tools-libs-develUpgrade kernel-zfcpdump-develUpgrade python3-perfUpgrade kernel-rt-debug-coreUpgrade kernel-headersUpgrade kernel-debugUpgrade kernel-64kUpgrade kernel-develUpgrade kernel-rt-debug-modulesUpgrade kernelUpgrade kernel-64k-modules-coreUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-modulesUpgrade kernel-64k-debug-coreUpgrade kernel-rt-debug-develUpgrade kernel-debug-develUpgrade kernel-rt-develUpgrade kernel-debug-coreUpgrade kernel-64k-modulesUpgrade kernel-64k-debug-modulesUpgrade kernel-modules-extraUpgrade kernel-rt-debugUpgrade kernel-rt-coreUpgrade kernel-coreUpgrade kernel-rt-modules-extraUpgrade perfUpgrade kernel-cross-headers | Oct 14, 2026 | Oct 14, 2026 |
| Debian | — | Upgrade linuxUpgrade linux-6.12 | Sep 21, 2026 | Sep 4, 2026 |
| Redhat_linux | — | No solution existsUpgrade kernelUpgrade kernel-rt | Oct 8, 2026 | Sep 4, 2026 |
| Rocky_linux | — | Upgrade kernel-toolsUpgrade kernel-debug-coreUpgrade kernel-debug-debuginfoUpgrade kernel-debug-uki-virtUpgrade kernel-modules-coreUpgrade kernel-devel-matchedUpgrade kernel-rtUpgrade kernel-rt-modules-coreUpgrade kernel-uki-virtUpgrade kernel-debuginfo-common-s390xUpgrade kernel-rt-debug-develUpgrade perfUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-rt-debug-modules-extraUpgrade kernel-zfcpdump-modulesUpgrade libperfUpgrade kernel-coreUpgrade kernel-rt-modulesUpgrade kernel-tools-debuginfoUpgrade kernel-debug-devel-matchedUpgrade kernel-uki-virt-addonsUpgrade kernel-rt-debug-modulesUpgrade perf-debuginfoUpgrade kernel-debug-modules-extraUpgrade kernel-debugUpgrade kernel-modulesUpgrade kernel-develUpgrade kernel-modules-extraUpgrade rvUpgrade kernel-debug-develUpgrade kernel-rt-debug-modules-coreUpgrade kernel-zfcpdump-develUpgrade kernel-zfcpdump-modules-coreUpgrade rtlaUpgrade kernel-debuginfoUpgrade kernel-zfcpdumpUpgrade kernel-rt-debuginfoUpgrade kernel-debug-modulesUpgrade kernel-zfcpdump-coreUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-rt-coreUpgrade kernel-rt-debug-debuginfoUpgrade python3-perfUpgrade kernel-tools-libsUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-rt-debugUpgrade python3-perf-debuginfoUpgrade kernel-rt-modules-extraUpgrade kernel-rt-debug-coreUpgrade libperf-debuginfoUpgrade kernel-rt-develUpgrade kernel-debug-modules-coreUpgrade kernel-tools-libs-develUpgrade kernel | Oct 16, 2026 | Oct 14, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Sep 21, 2026 | Sep 4, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub