CVE-2026-80888

    Dashboard / Vulnerabilities / CVE-2026-80888

    CVE-2026-80888

    Published: 4 Sept 2026Last Modified: 16 Sept 2026

    Summary: drm/vmwgfx: drop dma_buf reference on foreign-fd prime import

    Details: In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: drop dma_buf reference on foreign-fd prime import ttm_prime_fd_to_handle() returns -ENOSYS when the imported fd's dma_buf->ops do not match the ttm_object_device's ops, but does so without releasing the reference acquired by dma_buf_get(). Any unprivileged renderD client passing a non-vmwgfx prime fd through the DRM_VMW_GB_SURFACE_REF{,_EXT} path leaks one dma_buf reference per call and indefinitely pins the foreign exporter's GEM resources. Funnel the error path through the existing dma_buf_put() so the reference is always dropped.

    References: https://git.kernel.org/stable/c/1715901e7052cf90fbf04c8303e563a47e021278, https://git.kernel.org/stable/c/4df39eb99bb47d1f24d1952c23b21b10988356bf, https://git.kernel.org/stable/c/619c3cfa88e09603a13d918f754808db2dda7057, https://git.kernel.org/stable/c/a1e972fa94c3a8069e022c67b9d97c7aa7b05293, https://git.kernel.org/stable/c/a8434b145b1e467940334c58c00af241e9494c5f, https://git.kernel.org/stable/c/c1c22fca0a0896a452a7cb92422d67babd65b4be, https://git.kernel.org/stable/c/c4fd91ee7228f56fbb4cf528757dc17ffefeb0ee, https://git.kernel.org/stable/c/f739416dc555fa205a785e5135d73fa39b26f35d, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80888.json, https://nvd.nist.gov/vuln/detail/CVE-2026-80888, https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 65981f7681abdf92b25942222b629b9c512d0705
    Fixed -1715901e7052cf90fbf04c8303e563a47e021278

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-80888 | CVE-DB