Linux kernel: Out-of-bounds read in vmwgfx cursor snooping
Summary
The vmwgfx graphics driver of the Linux kernel did not validate the pitch from userspace together with the box dimensions before copying surface data for cursor snooping. A local user with low privileges can trigger out-of-bounds reads, which may lead to information disclosure. The issue affects Linux guests that use the vmwgfx driver, typically VMware virtual machines with virtual graphics.
Affected
- Linux kernel branches from commit 2ac863719e518ae1a8f328849e64ea26a222f079 (introduced in 3.2) until the fixed stable releases
- Fixed stable releases per OSV: 5.10.273, 5.15.224, 6.1.191, 6.6.160, 6.12.114, 6.18.57, 7.2.11
- Mainline 7.3 contains the original fix commit
- Distribution kernels: Unknown
Fixed in
- Stable kernel releases 5.10.273, 5.15.224, 6.1.191, 6.6.160, 6.12.114, 6.18.57 and 7.2.11 and later
- Fix commits include db6fbc2b77849e3c3c2bc115ea9ac925c4625a0d, f6d9c8abdf06a9c7efa799532d66ed8d5a50734c, 76e5ddd7d9822c8c3492e0f50ba8978e093069ad, fcb137f6e7ed769f7ecad84364a33c451371b602 and 21bc51cb89ced74d6645a138cc2f21184bc75094
- Fixed package versions of distributions: Unknown
Workaround
- None known for systems with a fixed kernel.
- Unverified option: blacklist the vmwgfx module if it is not needed, but this may break 3D and display acceleration in VMs.
Exploitation
- No known exploitation in the wild.
- CISA KEV: not listed.
- Public technical details were posted to the dri-devel mailing list in August 2026. No public proof of concept was found.
Our recommendation
- Install the distribution's kernel update in the normal patch cycle, with priority on multi-user Linux hosts and shared VDI.
- Check whether the vmwgfx module is loaded on your VMs with 'lsmod | grep vmwgfx'.
- Check with your distribution whether the fixed kernel package is available.
- Priority: medium to low, because the attack requires local access.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE-2026-99002 on OSV osv.dev
- Linux stable commit 073437615a8da528935146ca6a17292c0ca8ce19 git.kernel.org
- Linux stable commit db6fbc2b77849e3c3c2bc115ea9ac925c4625a0d git.kernel.org
- Linux stable commit f6d9c8abdf06a9c7efa799532d66ed8d5a50734c git.kernel.org
- Linux stable commit fcb137f6e7ed769f7ecad84364a33c451371b602 git.kernel.org
- Ubuntu security notice CVE-2026-99002 ubuntu.com
- VulDB entry 425878 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 22:32.
Original description (NVD)
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate pitch coming from userspace Validate the pitch, alongside the box dimensions before trying to copy data from the underlying surface. Fixes possible out of bounds reads with cursor snooping.
NVD references (8)
- https://git.kernel.org/stable/c/073437615a8da528935146ca6a17292c0ca8ce19
- https://git.kernel.org/stable/c/21bc51cb89ced74d6645a138cc2f21184bc75094
- https://git.kernel.org/stable/c/76e5ddd7d9822c8c3492e0f50ba8978e093069ad
- https://git.kernel.org/stable/c/cbf7616464334b217ed07b8adacaed549f2a9433
- https://git.kernel.org/stable/c/db6fbc2b77849e3c3c2bc115ea9ac925c4625a0d
- https://git.kernel.org/stable/c/f54b41644744f72c86e44a21733ac6fc910ca133
- https://git.kernel.org/stable/c/f6d9c8abdf06a9c7efa799532d66ed8d5a50734c
- https://git.kernel.org/stable/c/fcb137f6e7ed769f7ecad84364a33c451371b602
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.