CVE-2026-80888

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/vmwgfx: drop dma_buf reference on foreign-fd prime import

ttm_prime_fd_to_handle() returns -ENOSYS when the imported fd's

dma_buf->ops do not match the ttm_object_device's ops, but does so

without releasing the reference acquired by dma_buf_get(). Any

unprivileged renderD client passing a non-vmwgfx prime fd through the

DRM_VMW_GB_SURFACE_REF{,_EXT} path leaks one dma_buf reference per

call and indefinitely pins the foreign exporter's GEM resources.

Funnel the error path through the existing dma_buf_put() so the

reference is always dropped.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References