Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2025-40277

drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE This data originates from userspace and is used in buffer offset calculations which could potentially overflow causing an out-of-bounds access.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 8ce75f8ab9044fe11caaaf2b2c82471023212f9f to < e58559845021c3bad5e094219378b869157fad53affected
  • 8ce75f8ab9044fe11caaaf2b2c82471023212f9f to < 54d458b244893e47bda52ec3943fdfbc8d7d068baffected
  • 8ce75f8ab9044fe11caaaf2b2c82471023212f9f to < 709e5c088f9c99a5cf2c1d1c6ce58f2cca7ab173affected
  • 8ce75f8ab9044fe11caaaf2b2c82471023212f9f to < a3abb54c27b2c393c44362399777ad2f6e1ff17eaffected
  • 8ce75f8ab9044fe11caaaf2b2c82471023212f9f to < b5df9e06eed3df6a4f5c6f8453013b0cabb927b4affected
  • 8ce75f8ab9044fe11caaaf2b2c82471023212f9f to < 5aea2cde03d4247cdcf53f9ab7d0747c9dca1cfcaffected
  • 8ce75f8ab9044fe11caaaf2b2c82471023212f9f to < f3f3a8eb3f0ba799fae057091d8c67cca12d6fa0affected
  • 8ce75f8ab9044fe11caaaf2b2c82471023212f9f to < 32b415a9dc2c212e809b7ebc2b14bc3fbda2b9afaffected

Linux Linux

Default version status: affected

  • 4.3affected
  • 0 to < 4.3unaffected
  • 5.4.302 to ≤ 5.4.*unaffected
  • 5.10.247 to ≤ 5.10.*unaffected
  • 5.15.197 to ≤ 5.15.*unaffected
  • 6.1.159 to ≤ 6.1.*unaffected
  • 6.6.117 to ≤ 6.6.*unaffected
  • 6.12.59 to ≤ 6.12.*unaffected
  • 6.17.9 to ≤ 6.17.*unaffected
  • 6.18 to ≤ *unaffected

References