What’s Vulnerable › Vulnerabilities

CVE-2026-99002: drm/vmwgfx: validate pitch coming from userspace

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-23 · updated 2026-10-30

Description

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate pitch coming from userspace Validate the pitch, alongside the box dimensions before trying to copy data from the underlying surface. Fixes possible out of bounds reads with cursor snooping.

Affected products

• Linux: 3.2 — fixed in 7.3

How to fix

Upgrade to a fixed version: Linux 7.3. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/073437615a8da528935146ca6a17292c0ca8ce19
• https://git.kernel.org/stable/c/21bc51cb89ced74d6645a138cc2f21184bc75094
• https://git.kernel.org/stable/c/76e5ddd7d9822c8c3492e0f50ba8978e093069ad
• https://git.kernel.org/stable/c/cbf7616464334b217ed07b8adacaed549f2a9433
• https://git.kernel.org/stable/c/db6fbc2b77849e3c3c2bc115ea9ac925c4625a0d
• https://git.kernel.org/stable/c/f54b41644744f72c86e44a21733ac6fc910ca133
• https://git.kernel.org/stable/c/f6d9c8abdf06a9c7efa799532d66ed8d5a50734c
• https://git.kernel.org/stable/c/fcb137f6e7ed769f7ecad84364a33c451371b602

Get alerted when CVE-2026-99002 or the next vulnerability affects your stack