CVE-2026-23008: drm/vmwgfx: Fix KMS with 3D on HW version 10

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-01-25 · updated 2026-06-17
Weakness: CWE-476

Description

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix KMS with 3D on HW version 10 HW version 10 does not have GB Surfaces so there is no backing buffer for surface backed FBs. This would result in a nullptr dereference and crash the driver causing a black screen.

Affected products

Linux kernel: from 6.16.1 before 6.18.7; 6.16, 6.19-rc1, 6.19-rc2, 6.19-rc3, 6.19-rc4, 6.19-rc5 (+3) — fixed in 6.18.7

How to fix

Upgrade to a fixed version: Linux kernel 6.18.7. Check the vendor advisory for mitigations.

References

https://git.kernel.org/stable/c/a91bdd21d5efb3072beefbec13762b7722200c49
https://git.kernel.org/stable/c/d9186faeae6efb7d0841a5e8eb213ff4c7966614

Get alerted when CVE-2026-23008 or the next vulnerability affects your stack