Answer in brief
CVE-2026-80702 records a Unknown severity vulnerability in drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=668b206601c5f5063e03b76784a0d3024fa2b249 <21bbe38faee4a195d33a93e3908e307807f7745d || >=668b206601c5f5063e03b76784a0d3024fa2b249 <9d6cbb76fe9cd760351f6b0b20f1bf788eab8fa6 || >=668b206601c5f5063e03b76784a0d3024fa2b249 <282f261cb035e5f01a486f76d356b7e9dbfba73f || >=668b206601c5f5063e03b76784a0d3024fa2b249 <3b2bb16a5b622867140d69925db411ac8ecb3b2b || >=668b206601c5f5063e03b76784a0d3024fa2b249 <83195b778f2d109a3a4f3ffaba4dce7e4cdb58aa | 21bbe38faee4a195d33a93e3908e307807f7745d, 9d6cbb76fe9cd760351f6b0b20f1bf788eab8fa6, 282f261cb035e5f01a486f76d356b7e9dbfba73f, 3b2bb16a5b622867140d69925db411ac8ecb3b2b, 83195b778f2d109a3a4f3ffaba4dce7e4cdb58aa |
| Linux/Linuxgeneric | 6.4 | Not reported |
Published upstream
Aug 28, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 28, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 28, 2026
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size Two sites in vmwgfx_resource.c assign boolean literals to res->guest_memory_size, which is an unsigned long allocation-size field; the intended target is the adjacent res->guest_memory_dirty bitfield. After the assignments the field holds 0 or 1 instead of the resource's MOB allocation size: - vmw_resource_release() writes 0 (false), and - vmw_resource_unbind_list() writes 1 (true). Subsequent revalidation paths read guest_memory_size when computing the dirty page range (vmw_bo_dirty_transfer_to_res()) and the buffer allocation size (vmw_resource_buf_alloc()), producing zero-length walks or wrap-around ranges that read or write past the MOB bitmap. The dirty-tracking intent of the original code (mark the resource as dirtied since the last sync) is also lost, since guest_memory_dirty is never updated. Rename both assignments to guest_memory_dirty.
Quoted source text, attributed separately from HOL analysis.