{"id":"CVE-2026-99002","kind":"vulnerability","aliases":["CVE-2026-99002"],"related":[],"title":"Linux kernel vmwgfx driver: unchecked userspace pitch allows out-of-bounds reads","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: validate pitch coming from userspace\n\nValidate the pitch, alongside the box dimensions before trying\nto copy data from the underlying surface. Fixes possible\nout of bounds reads with cursor snooping.","summary":"The VMware graphics (vmwgfx) driver in the Linux kernel did not validate the pitch value supplied by userspace before copying surface data. A local process can trigger out-of-bounds reads during cursor snooping.","severity":"unknown","cvss":null,"epss":0.00209,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","linux-kernel","virtual-machines","vmware"],"not_affected_if":["no-vmwgfx-driver"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-23T13:17:22+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:55:55+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T04:55:55Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"local","title":"Linux kernel vmwgfx driver: unchecked userspace pitch allows out-of-bounds reads","impact":"low","summary":"The VMware graphics (vmwgfx) driver in the Linux kernel did not validate the pitch value supplied by userspace before copying surface data. A local process can trigger out-of-bounds reads during cursor snooping.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","vmware","virtual-machines"],"confidence":0.5,"needs_auth":"unknown","worst_case":"local process reads kernel memory out of bounds","analyst_note":"Check the upstream kernel commit and stable backports for affected and fixed versions, and whether cursor snooping is enabled by default.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-vmwgfx-driver"],"who_is_affected":"Systems running a Linux kernel with the vmwgfx DRM driver, typically VMware virtual machines using the virtual GPU. The sources do not say which kernel versions are fixed or whether the driver is loaded by default.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000551,"input_tokens":3316,"output_tokens":438,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-99002':16A,19A 'allow':8A 'alongsid':82C 'bound':12A,58B,99C 'box':84C 'come':76C 'copi':47B,89C 'cursor':61B,102C 'cve':14A,17A 'data':49B,90C 'dimens':85C 'driver':4A,32B 'drm/vmwgfx':73C 'fix':95C 'follow':68C 'graphic':30B 'infrastructur':20B 'kernel':2A,23B,36B,66C 'linux':1A,22B,35B,65C 'linux-kernel':21B 'local':51B 'machin':26B 'out-of-bound':9A,55B 'pitch':7A,41B,75C,81C 'possibl':96C 'process':52B 'read':13A,59B,100C 'resolv':72C 'snoop':62B,103C 'suppli':43B 'surfac':48B,94C 'tri':87C 'trigger':54B 'uncheck':5A 'under':93C 'userspac':6A,45B,78C 'valid':39B,74C,79C 'valu':42B 'virtual':25B 'virtual-machin':24B 'vmware':27B,29B 'vmwgfx':3A,31B 'vulner':69C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the vmwgfx DRM driver, typically VMware virtual machines using the virtual GPU. The sources do not say which kernel versions are fixed or whether the driver is loaded by default.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:22+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99002","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99002","severity":null,"published_at":"2026-10-23T13:17:22+00:00","modified_at":"2026-10-23T13:17:22+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-99002","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-99002","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}