CVE-2026-80888

drm/vmwgfx: drop dma_buf reference on foreign-fd prime import

State: Published
Severity: Not scored
Published: Sep 4, 2026
Updated: Sep 14, 2026
Reserved: Aug 26, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/vmwgfx: drop dma_buf reference on foreign-fd prime import

ttm_prime_fd_to_handle() returns -ENOSYS when the imported fd's dma_buf->ops do not match the ttm_object_device's ops, but does so without releasing the reference acquired by dma_buf_get(). Any unprivileged renderD client passing a non-vmwgfx prime fd through the DRM_VMW_GB_SURFACE_REF{,_EXT} path leaks one dma_buf reference per call and indefinitely pins the foreign exporter's GEM resources.

Funnel the error path through the existing dma_buf_put() so the reference is always dropped.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	65981f7681abdf92b25942222b629b9c512d0705 to before 1715901e7052cf90fbf04c8303e563a47e021278Affected 65981f7681abdf92b25942222b629b9c512d0705 to before c4fd91ee7228f56fbb4cf528757dc17ffefeb0eeAffected 65981f7681abdf92b25942222b629b9c512d0705 to before 619c3cfa88e09603a13d918f754808db2dda7057Affected 65981f7681abdf92b25942222b629b9c512d0705 to before c1c22fca0a0896a452a7cb92422d67babd65b4beAffected 65981f7681abdf92b25942222b629b9c512d0705 to before a1e972fa94c3a8069e022c67b9d97c7aa7b05293Affected 65981f7681abdf92b25942222b629b9c512d0705 to before a8434b145b1e467940334c58c00af241e9494c5fAffected 65981f7681abdf92b25942222b629b9c512d0705 to before 4df39eb99bb47d1f24d1952c23b21b10988356bfAffected 65981f7681abdf92b25942222b629b9c512d0705 to before f739416dc555fa205a785e5135d73fa39b26f35dAffected
LinuxLinux	3.13Affected before 3.13Not affected 5.10.270 through 5.10.Not affected 5.15.221 through 5.15.Not affected 6.1.183 through 6.1.Not affected 6.6.151 through 6.6.Not affected 6.12.103 through 6.12.Not affected 6.18.44 through 6.18.Not affected 7.1.8 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

65981f7681abdf92b25942222b629b9c512d0705 to before 1715901e7052cf90fbf04c8303e563a47e021278Affected
65981f7681abdf92b25942222b629b9c512d0705 to before c4fd91ee7228f56fbb4cf528757dc17ffefeb0eeAffected
65981f7681abdf92b25942222b629b9c512d0705 to before 619c3cfa88e09603a13d918f754808db2dda7057Affected
65981f7681abdf92b25942222b629b9c512d0705 to before c1c22fca0a0896a452a7cb92422d67babd65b4beAffected
65981f7681abdf92b25942222b629b9c512d0705 to before a1e972fa94c3a8069e022c67b9d97c7aa7b05293Affected
65981f7681abdf92b25942222b629b9c512d0705 to before a8434b145b1e467940334c58c00af241e9494c5fAffected
65981f7681abdf92b25942222b629b9c512d0705 to before 4df39eb99bb47d1f24d1952c23b21b10988356bfAffected
65981f7681abdf92b25942222b629b9c512d0705 to before f739416dc555fa205a785e5135d73fa39b26f35dAffected

LinuxLinux

3.13Affected
before 3.13Not affected
5.10.270 through 5.10.*Not affected
5.15.221 through 5.15.*Not affected
6.1.183 through 6.1.*Not affected
6.6.151 through 6.6.*Not affected
6.12.103 through 6.12.*Not affected
6.18.44 through 6.18.*Not affected
7.1.8 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.