CVE-2026-23317 (GCVE-0-2026-23317)

Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-04-13 06:04
VLAI?
Title
drm/vmwgfx: Return the correct value in vmw_translate_ptr functions
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Return the correct value in vmw_translate_ptr functions Before the referenced fixes these functions used a lookup function that returned a pointer. This was changed to another lookup function that returned an error code with the pointer becoming an out parameter. The error path when the lookup failed was not changed to reflect this change and the code continued to return the PTR_ERR of the now uninitialized pointer. This could cause the vmw_translate_ptr functions to return success when they actually failed causing further uninitialized and OOB accesses.
Severity ?
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 7ac9578e45b20e3f3c0c8eb71f5417a499a7226a , < ce3a5cf139787c186d5d54336107298cacaad2b9 (git)
Affected: a309c7194e8a2f8bd4539b9449917913f6c2cd50 , < 7e55d0788b362c93660b80cc5603031bbbdefa98 (git)
Affected: a309c7194e8a2f8bd4539b9449917913f6c2cd50 , < 36cb28b6d303a81e6ed4536017090e85e0143e42 (git)
Affected: a309c7194e8a2f8bd4539b9449917913f6c2cd50 , < 531f45589787799aa81b63e1e1f8e71db5d93dd1 (git)
Affected: a309c7194e8a2f8bd4539b9449917913f6c2cd50 , < 149f028772fa2879d9316b924ce948a6a0877e45 (git)
Affected: a309c7194e8a2f8bd4539b9449917913f6c2cd50 , < 5023ca80f9589295cb60735016e39fc5cc714243 (git)
Create a notification for this product.
    Linux Linux Affected: 6.2
Unaffected: 0 , < 6.2 (semver)
Unaffected: 6.1.167 , ≤ 6.1.* (semver)
Unaffected: 6.6.130 , ≤ 6.6.* (semver)
Unaffected: 6.12.77 , ≤ 6.12.* (semver)
Unaffected: 6.18.17 , ≤ 6.18.* (semver)
Unaffected: 6.19.7 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ce3a5cf139787c186d5d54336107298cacaad2b9",
              "status": "affected",
              "version": "7ac9578e45b20e3f3c0c8eb71f5417a499a7226a",
              "versionType": "git"
            },
            {
              "lessThan": "7e55d0788b362c93660b80cc5603031bbbdefa98",
              "status": "affected",
              "version": "a309c7194e8a2f8bd4539b9449917913f6c2cd50",
              "versionType": "git"
            },
            {
              "lessThan": "36cb28b6d303a81e6ed4536017090e85e0143e42",
              "status": "affected",
              "version": "a309c7194e8a2f8bd4539b9449917913f6c2cd50",
              "versionType": "git"
            },
            {
              "lessThan": "531f45589787799aa81b63e1e1f8e71db5d93dd1",
              "status": "affected",
              "version": "a309c7194e8a2f8bd4539b9449917913f6c2cd50",
              "versionType": "git"
            },
            {
              "lessThan": "149f028772fa2879d9316b924ce948a6a0877e45",
              "status": "affected",
              "version": "a309c7194e8a2f8bd4539b9449917913f6c2cd50",
              "versionType": "git"
            },
            {
              "lessThan": "5023ca80f9589295cb60735016e39fc5cc714243",
              "status": "affected",
              "version": "a309c7194e8a2f8bd4539b9449917913f6c2cd50",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.167",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.130",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.77",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.17",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.167",
                  "versionStartIncluding": "6.1.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.130",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.77",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.17",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.7",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: Return the correct value in vmw_translate_ptr functions\n\nBefore the referenced fixes these functions used a lookup function that\nreturned a pointer. This was changed to another lookup function that\nreturned an error code with the pointer becoming an out parameter.\n\nThe error path when the lookup failed was not changed to reflect this\nchange and the code continued to return the PTR_ERR of the now\nuninitialized pointer. This could cause the vmw_translate_ptr functions\nto return success when they actually failed causing further uninitialized\nand OOB accesses."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-13T06:04:16.604Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ce3a5cf139787c186d5d54336107298cacaad2b9"
        },
        {
          "url": "https://git.kernel.org/stable/c/7e55d0788b362c93660b80cc5603031bbbdefa98"
        },
        {
          "url": "https://git.kernel.org/stable/c/36cb28b6d303a81e6ed4536017090e85e0143e42"
        },
        {
          "url": "https://git.kernel.org/stable/c/531f45589787799aa81b63e1e1f8e71db5d93dd1"
        },
        {
          "url": "https://git.kernel.org/stable/c/149f028772fa2879d9316b924ce948a6a0877e45"
        },
        {
          "url": "https://git.kernel.org/stable/c/5023ca80f9589295cb60735016e39fc5cc714243"
        }
      ],
      "title": "drm/vmwgfx: Return the correct value in vmw_translate_ptr functions",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23317",
    "datePublished": "2026-03-25T10:27:11.884Z",
    "dateReserved": "2026-01-13T15:37:45.995Z",
    "dateUpdated": "2026-04-13T06:04:16.604Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-23317",
      "date": "2026-04-14",
      "epss": "0.00013",
      "percentile": "0.02295"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-23317\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-03-25T11:16:28.220\",\"lastModified\":\"2026-04-02T15:16:30.920\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/vmwgfx: Return the correct value in vmw_translate_ptr functions\\n\\nBefore the referenced fixes these functions used a lookup function that\\nreturned a pointer. This was changed to another lookup function that\\nreturned an error code with the pointer becoming an out parameter.\\n\\nThe error path when the lookup failed was not changed to reflect this\\nchange and the code continued to return the PTR_ERR of the now\\nuninitialized pointer. This could cause the vmw_translate_ptr functions\\nto return success when they actually failed causing further uninitialized\\nand OOB accesses.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\\n\\ndrm/vmwgfx: Devolver el valor correcto en las funciones vmw_translate_ptr\\n\\nAntes de las correcciones referenciadas, estas funciones utilizaban una funci\u00f3n de b\u00fasqueda que devolv\u00eda un puntero. Esto fue cambiado a otra funci\u00f3n de b\u00fasqueda que devolv\u00eda un c\u00f3digo de error con el puntero convirti\u00e9ndose en un par\u00e1metro de salida.\\n\\nLa ruta de error cuando la b\u00fasqueda fallaba no fue cambiada para reflejar este cambio y el c\u00f3digo continu\u00f3 devolviendo el PTR_ERR del puntero ahora no inicializado. Esto podr\u00eda causar que las funciones vmw_translate_ptr devolvieran \u00e9xito cuando en realidad fallaron, causando accesos no inicializados y OOB adicionales.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/149f028772fa2879d9316b924ce948a6a0877e45\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/36cb28b6d303a81e6ed4536017090e85e0143e42\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5023ca80f9589295cb60735016e39fc5cc714243\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/531f45589787799aa81b63e1e1f8e71db5d93dd1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7e55d0788b362c93660b80cc5603031bbbdefa98\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ce3a5cf139787c186d5d54336107298cacaad2b9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.