CVE-2026-80888

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: drop dma_buf reference on foreign-fd prime import ttm_prime_fd_to_handle() returns -ENOSYS when the imported fd's dma_buf->ops do not match the ttm_object_device's ops, but does so without releasing the reference acquired by dma_buf_get(). Any unprivileged renderD client passing a non-vmwgfx prime fd through the DRM_VMW_GB_SURFACE_REF{,_EXT} path leaks one dma_buf reference per call and indefinitely pins the foreign exporter's GEM resources. Funnel the error path through the existing dma_buf_put() so the reference is always dropped.

CVSS

No CVSS.

References

Link	Resource
https://git.kernel.org/stable/c/1715901e7052cf90fbf04c8303e563a47e021278
https://git.kernel.org/stable/c/4df39eb99bb47d1f24d1952c23b21b10988356bf
https://git.kernel.org/stable/c/619c3cfa88e09603a13d918f754808db2dda7057
https://git.kernel.org/stable/c/a1e972fa94c3a8069e022c67b9d97c7aa7b05293
https://git.kernel.org/stable/c/a8434b145b1e467940334c58c00af241e9494c5f
https://git.kernel.org/stable/c/c1c22fca0a0896a452a7cb92422d67babd65b4be
https://git.kernel.org/stable/c/c4fd91ee7228f56fbb4cf528757dc17ffefeb0ee
https://git.kernel.org/stable/c/f739416dc555fa205a785e5135d73fa39b26f35d

Configurations

No configuration.

History

No history.

Information

Published : 2026-09-04 18:17

Updated : 2026-09-14 13:18

NVD link : CVE-2026-80888

Mitre link : CVE-2026-80888

CVE.ORG link : CVE-2026-80888

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2026-80888", "cveTags": [], "metrics": {}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "65981f7681abdf92b25942222b629b9c512d0705", "lessThan": "1715901e7052cf90fbf04c8303e563a47e021278", "versionType": "git"}, {"status": "affected", "version": "65981f7681abdf92b25942222b629b9c512d0705", "lessThan": "c4fd91ee7228f56fbb4cf528757dc17ffefeb0ee", "versionType": "git"}, {"status": "affected", "version": "65981f7681abdf92b25942222b629b9c512d0705", "lessThan": "619c3cfa88e09603a13d918f754808db2dda7057", "versionType": "git"}, {"status": "affected", "version": "65981f7681abdf92b25942222b629b9c512d0705", "lessThan": "c1c22fca0a0896a452a7cb92422d67babd65b4be", "versionType": "git"}, {"status": "affected", "version": "65981f7681abdf92b25942222b629b9c512d0705", "lessThan": "a1e972fa94c3a8069e022c67b9d97c7aa7b05293", "versionType": "git"}, {"status": "affected", "version": "65981f7681abdf92b25942222b629b9c512d0705", "lessThan": "a8434b145b1e467940334c58c00af241e9494c5f", "versionType": "git"}, {"status": "affected", "version": "65981f7681abdf92b25942222b629b9c512d0705", "lessThan": "4df39eb99bb47d1f24d1952c23b21b10988356bf", "versionType": "git"}, {"status": "affected", "version": "65981f7681abdf92b25942222b629b9c512d0705", "lessThan": "f739416dc555fa205a785e5135d73fa39b26f35d", "versionType": "git"}], "programFiles": ["drivers/gpu/drm/vmwgfx/ttm_object.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3.13"}, {"status": "unaffected", "version": "0", "lessThan": "3.13", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.270", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.221", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.183", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.151", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.103", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.44", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.8", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/gpu/drm/vmwgfx/ttm_object.c"], "defaultStatus": "affected"}]}], "published": "2026-09-04T18:17:56.787", "references": [{"url": "https://git.kernel.org/stable/c/1715901e7052cf90fbf04c8303e563a47e021278", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/4df39eb99bb47d1f24d1952c23b21b10988356bf", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/619c3cfa88e09603a13d918f754808db2dda7057", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/a1e972fa94c3a8069e022c67b9d97c7aa7b05293", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/a8434b145b1e467940334c58c00af241e9494c5f", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/c1c22fca0a0896a452a7cb92422d67babd65b4be", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/c4fd91ee7228f56fbb4cf528757dc17ffefeb0ee", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/f739416dc555fa205a785e5135d73fa39b26f35d", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Received", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: drop dma_buf reference on foreign-fd prime import\n\nttm_prime_fd_to_handle() returns -ENOSYS when the imported fd's\ndma_buf->ops do not match the ttm_object_device's ops, but does so\nwithout releasing the reference acquired by dma_buf_get(). Any\nunprivileged renderD client passing a non-vmwgfx prime fd through the\nDRM_VMW_GB_SURFACE_REF{,_EXT} path leaks one dma_buf reference per\ncall and indefinitely pins the foreign exporter's GEM resources.\n\nFunnel the error path through the existing dma_buf_put() so the\nreference is always dropped."}], "lastModified": "2026-09-14T13:18:48.630", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}