Answer in brief
CVE-2026-80888 records a Unknown severity vulnerability in drm/vmwgfx: drop dma_buf reference on foreign-fd prime import. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=65981f7681abdf92b25942222b629b9c512d0705 <619c3cfa88e09603a13d918f754808db2dda7057 || >=65981f7681abdf92b25942222b629b9c512d0705 <c1c22fca0a0896a452a7cb92422d67babd65b4be || >=65981f7681abdf92b25942222b629b9c512d0705 <a1e972fa94c3a8069e022c67b9d97c7aa7b05293 || >=65981f7681abdf92b25942222b629b9c512d0705 <a8434b145b1e467940334c58c00af241e9494c5f || >=65981f7681abdf92b25942222b629b9c512d0705 <4df39eb99bb47d1f24d1952c23b21b10988356bf || >=65981f7681abdf92b25942222b629b9c512d0705 <f739416dc555fa205a785e5135d73fa39b26f35d | 619c3cfa88e09603a13d918f754808db2dda7057, c1c22fca0a0896a452a7cb92422d67babd65b4be, a1e972fa94c3a8069e022c67b9d97c7aa7b05293, a8434b145b1e467940334c58c00af241e9494c5f, 4df39eb99bb47d1f24d1952c23b21b10988356bf, f739416dc555fa205a785e5135d73fa39b26f35d |
| Linux/Linuxgeneric | 3.13 | Not reported |
| Linux/Linuxgeneric | >=65981f7681abdf92b25942222b629b9c512d0705 <1715901e7052cf90fbf04c8303e563a47e021278 || >=65981f7681abdf92b25942222b629b9c512d0705 <c4fd91ee7228f56fbb4cf528757dc17ffefeb0ee || >=65981f7681abdf92b25942222b629b9c512d0705 <619c3cfa88e09603a13d918f754808db2dda7057 || >=65981f7681abdf92b25942222b629b9c512d0705 <c1c22fca0a0896a452a7cb92422d67babd65b4be || >=65981f7681abdf92b25942222b629b9c512d0705 <a1e972fa94c3a8069e022c67b9d97c7aa7b05293 || >=65981f7681abdf92b25942222b629b9c512d0705 <a8434b145b1e467940334c58c00af241e9494c5f || >=65981f7681abdf92b25942222b629b9c512d0705 <4df39eb99bb47d1f24d1952c23b21b10988356bf || >=65981f7681abdf92b25942222b629b9c512d0705 <f739416dc555fa205a785e5135d73fa39b26f35d | 1715901e7052cf90fbf04c8303e563a47e021278, c4fd91ee7228f56fbb4cf528757dc17ffefeb0ee, 619c3cfa88e09603a13d918f754808db2dda7057, c1c22fca0a0896a452a7cb92422d67babd65b4be, a1e972fa94c3a8069e022c67b9d97c7aa7b05293, a8434b145b1e467940334c58c00af241e9494c5f, 4df39eb99bb47d1f24d1952c23b21b10988356bf, f739416dc555fa205a785e5135d73fa39b26f35d |
Published upstream
Sep 4, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 14, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 4, 2026
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: drop dma_buf reference on foreign-fd prime import ttm_prime_fd_to_handle() returns -ENOSYS when the imported fd's dma_buf->ops do not match the ttm_object_device's ops, but does so without releasing the reference acquired by dma_buf_get(). Any unprivileged renderD client passing a non-vmwgfx prime fd through the DRM_VMW_GB_SURFACE_REF{,_EXT} path leaks one dma_buf reference per call and indefinitely pins the foreign exporter's GEM resources. Funnel the error path through the existing dma_buf_put() so the reference is always dropped.
Quoted source text, attributed separately from HOL analysis.