CVE-2025-40277

drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE

State: Published
Severity: 7.8 High
Published: Dec 6, 2025
Updated: Aug 5, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE

This data originates from userspace and is used in buffer offset calculations which could potentially overflow causing an out-of-bounds access.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	8ce75f8ab9044fe11caaaf2b2c82471023212f9f to before e58559845021c3bad5e094219378b869157fad53Affected 8ce75f8ab9044fe11caaaf2b2c82471023212f9f to before 54d458b244893e47bda52ec3943fdfbc8d7d068bAffected 8ce75f8ab9044fe11caaaf2b2c82471023212f9f to before 709e5c088f9c99a5cf2c1d1c6ce58f2cca7ab173Affected 8ce75f8ab9044fe11caaaf2b2c82471023212f9f to before a3abb54c27b2c393c44362399777ad2f6e1ff17eAffected 8ce75f8ab9044fe11caaaf2b2c82471023212f9f to before b5df9e06eed3df6a4f5c6f8453013b0cabb927b4Affected 8ce75f8ab9044fe11caaaf2b2c82471023212f9f to before 5aea2cde03d4247cdcf53f9ab7d0747c9dca1cfcAffected 8ce75f8ab9044fe11caaaf2b2c82471023212f9f to before f3f3a8eb3f0ba799fae057091d8c67cca12d6fa0Affected 8ce75f8ab9044fe11caaaf2b2c82471023212f9f to before 32b415a9dc2c212e809b7ebc2b14bc3fbda2b9afAffected
LinuxLinux	4.3Affected before 4.3Not affected 5.4.302 through 5.4.Not affected 5.10.247 through 5.10.Not affected 5.15.197 through 5.15.Not affected 6.1.159 through 6.1.Not affected 6.6.117 through 6.6.Not affected 6.12.59 through 6.12.Not affected 6.17.9 through 6.17.*Not affected 6.18 and laterNot affected

Product

Versions

LinuxLinux

8ce75f8ab9044fe11caaaf2b2c82471023212f9f to before e58559845021c3bad5e094219378b869157fad53Affected
8ce75f8ab9044fe11caaaf2b2c82471023212f9f to before 54d458b244893e47bda52ec3943fdfbc8d7d068bAffected
8ce75f8ab9044fe11caaaf2b2c82471023212f9f to before 709e5c088f9c99a5cf2c1d1c6ce58f2cca7ab173Affected
8ce75f8ab9044fe11caaaf2b2c82471023212f9f to before a3abb54c27b2c393c44362399777ad2f6e1ff17eAffected
8ce75f8ab9044fe11caaaf2b2c82471023212f9f to before b5df9e06eed3df6a4f5c6f8453013b0cabb927b4Affected
8ce75f8ab9044fe11caaaf2b2c82471023212f9f to before 5aea2cde03d4247cdcf53f9ab7d0747c9dca1cfcAffected
8ce75f8ab9044fe11caaaf2b2c82471023212f9f to before f3f3a8eb3f0ba799fae057091d8c67cca12d6fa0Affected
8ce75f8ab9044fe11caaaf2b2c82471023212f9f to before 32b415a9dc2c212e809b7ebc2b14bc3fbda2b9afAffected

LinuxLinux

4.3Affected
before 4.3Not affected
5.4.302 through 5.4.*Not affected
5.10.247 through 5.10.*Not affected
5.15.197 through 5.15.*Not affected
6.1.159 through 6.1.*Not affected
6.6.117 through 6.6.*Not affected
6.12.59 through 6.12.*Not affected
6.17.9 through 6.17.*Not affected
6.18 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.