CVE-2026-99002

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate pitch coming from userspace Validate the pitch, alongside the box dimensions before trying to copy data from the underlying surface. Fixes possible out of bounds reads with cursor snooping.

CVSS 3.1

7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.2% chance of exploitation in the next 30 days; higher than 5% of CVEs (scores of 2026-10-25)

Published

2026-10-23

Modified

2026-10-24

Record from

the NVD, synced 2026-10-24

References

• https://git.kernel.org/stable/c/21bc51cb89ced74d6645a138cc2f21184bc75094
• https://git.kernel.org/stable/c/76e5ddd7d9822c8c3492e0f50ba8978e093069ad
• https://git.kernel.org/stable/c/db6fbc2b77849e3c3c2bc115ea9ac925c4625a0d
• https://git.kernel.org/stable/c/f6d9c8abdf06a9c7efa799532d66ed8d5a50734c
• https://git.kernel.org/stable/c/fcb137f6e7ed769f7ecad84364a33c451371b602

Check your stackJSON