CVE-2022-50440

drm/vmwgfx: Validate the box size for the snooped cursor

State: Published
Severity: 7.8 High
Published: Oct 1, 2025
Updated: Oct 15, 2026
Reserved: Sep 17, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/vmwgfx: Validate the box size for the snooped cursor

Invalid userspace dma surface copies could potentially overflow the memcpy from the surface to the snooped image leading to crashes. To fix it the dimensions of the copybox have to be validated against the expected size of the snooped cursor.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	2ac863719e518ae1a8f328849e64ea26a222f079 to before ee8d31836cbe7c26e207bfa0a4a726f0a25cfcf6Affected 2ac863719e518ae1a8f328849e64ea26a222f079 to before 50d177f90b63ea4138560e500d92be5e4c928186Affected 2ac863719e518ae1a8f328849e64ea26a222f079 to before 6b4e70a428b5a11f56db94047b68e144529fe512Affected 2ac863719e518ae1a8f328849e64ea26a222f079 to before 94b283341f9f3f0ed56a360533766377a01540e0Affected 2ac863719e518ae1a8f328849e64ea26a222f079 to before 439cbbc1519547f9a7b483f0de33b556ebfec901Affected 2ac863719e518ae1a8f328849e64ea26a222f079 to before 6948e570f54f2044dd4da444b10471373a047eebAffected 2ac863719e518ae1a8f328849e64ea26a222f079 to before 4d54d11b49860686331c58a00f733b16a93edfc4Affected 2ac863719e518ae1a8f328849e64ea26a222f079 to before 622d527decaac0eb65512acada935a0fdc1d0202Affected 2ac863719e518ae1a8f328849e64ea26a222f079 to before 4cf949c7fafe21e085a4ee386bb2dade9067316eAffected
LinuxLinux	3.2Affected before 3.2Not affected 4.9.337 through 4.9.Not affected 4.14.303 through 4.14.Not affected 4.19.270 through 4.19.Not affected 5.4.229 through 5.4.Not affected 5.10.163 through 5.10.Not affected 5.15.87 through 5.15.Not affected 6.0.18 through 6.0.Not affected 6.1.4 through 6.1.Not affected 6.2 and laterNot affected

Product

Versions

LinuxLinux

2ac863719e518ae1a8f328849e64ea26a222f079 to before ee8d31836cbe7c26e207bfa0a4a726f0a25cfcf6Affected
2ac863719e518ae1a8f328849e64ea26a222f079 to before 50d177f90b63ea4138560e500d92be5e4c928186Affected
2ac863719e518ae1a8f328849e64ea26a222f079 to before 6b4e70a428b5a11f56db94047b68e144529fe512Affected
2ac863719e518ae1a8f328849e64ea26a222f079 to before 94b283341f9f3f0ed56a360533766377a01540e0Affected
2ac863719e518ae1a8f328849e64ea26a222f079 to before 439cbbc1519547f9a7b483f0de33b556ebfec901Affected
2ac863719e518ae1a8f328849e64ea26a222f079 to before 6948e570f54f2044dd4da444b10471373a047eebAffected
2ac863719e518ae1a8f328849e64ea26a222f079 to before 4d54d11b49860686331c58a00f733b16a93edfc4Affected
2ac863719e518ae1a8f328849e64ea26a222f079 to before 622d527decaac0eb65512acada935a0fdc1d0202Affected
2ac863719e518ae1a8f328849e64ea26a222f079 to before 4cf949c7fafe21e085a4ee386bb2dade9067316eAffected

LinuxLinux

3.2Affected
before 3.2Not affected
4.9.337 through 4.9.*Not affected
4.14.303 through 4.14.*Not affected
4.19.270 through 4.19.*Not affected
5.4.229 through 5.4.*Not affected
5.10.163 through 5.10.*Not affected
5.15.87 through 5.15.*Not affected
6.0.18 through 6.0.*Not affected
6.1.4 through 6.1.*Not affected
6.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.