CVE-2026-68446

drm/vmwgfx: Validate vmw_surface_metadata::array_size

State: Published
Severity: 7.8 High
Published: Aug 12, 2026
Updated: Oct 19, 2026
Reserved: Jul 30, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/vmwgfx: Validate vmw_surface_metadata::array_size

This field comes from userspace and should be validated against specific limits depending on which Shader Model (SM) is available.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-20 Improper Input Validation

Affected Products

Product	Versions
LinuxLinux	504901dbb0b565fcbe466b0c56f3131586df5afd to before e949adf2d42678fb391a41db277e2fcb12090566Affected 504901dbb0b565fcbe466b0c56f3131586df5afd to before 0403cec2aff8037bc246cf9a0831eb169ddcd9dfAffected 504901dbb0b565fcbe466b0c56f3131586df5afd to before aded8463466ede7a7fbd1bbf821756c67c83e89bAffected 504901dbb0b565fcbe466b0c56f3131586df5afd to before 5ff94e1279176b539d451e3e754fdcbd1a8d520aAffected 504901dbb0b565fcbe466b0c56f3131586df5afd to before 71779fe8bf403a9b3e28dc59229fa556db32d35dAffected 504901dbb0b565fcbe466b0c56f3131586df5afd to before b1379f0c42b88cb60b9f3757eb5d1e73ad460ed8Affected 504901dbb0b565fcbe466b0c56f3131586df5afd to before 6910ccaf41678f7761ba2e57d72b77d056320b4dAffected 504901dbb0b565fcbe466b0c56f3131586df5afd to before a4f55260f7f7d4dc4d0ee55063dfb0c457b77991Affected
LinuxLinux	5.7Affected before 5.7Not affected 5.10.265 through 5.10.Not affected 5.15.216 through 5.15.Not affected 6.1.183 through 6.1.Not affected 6.6.148 through 6.6.Not affected 6.12.101 through 6.12.Not affected 6.18.42 through 6.18.Not affected 7.1.6 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

504901dbb0b565fcbe466b0c56f3131586df5afd to before e949adf2d42678fb391a41db277e2fcb12090566Affected
504901dbb0b565fcbe466b0c56f3131586df5afd to before 0403cec2aff8037bc246cf9a0831eb169ddcd9dfAffected
504901dbb0b565fcbe466b0c56f3131586df5afd to before aded8463466ede7a7fbd1bbf821756c67c83e89bAffected
504901dbb0b565fcbe466b0c56f3131586df5afd to before 5ff94e1279176b539d451e3e754fdcbd1a8d520aAffected
504901dbb0b565fcbe466b0c56f3131586df5afd to before 71779fe8bf403a9b3e28dc59229fa556db32d35dAffected
504901dbb0b565fcbe466b0c56f3131586df5afd to before b1379f0c42b88cb60b9f3757eb5d1e73ad460ed8Affected
504901dbb0b565fcbe466b0c56f3131586df5afd to before 6910ccaf41678f7761ba2e57d72b77d056320b4dAffected
504901dbb0b565fcbe466b0c56f3131586df5afd to before a4f55260f7f7d4dc4d0ee55063dfb0c457b77991Affected

LinuxLinux

5.7Affected
before 5.7Not affected
5.10.265 through 5.10.*Not affected
5.15.216 through 5.15.*Not affected
6.1.183 through 6.1.*Not affected
6.6.148 through 6.6.*Not affected
6.12.101 through 6.12.*Not affected
6.18.42 through 6.18.*Not affected
7.1.6 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.