CVE-2026-99002

CVSS 7.8 (high) · published 2026-10-23

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate pitch coming from userspace Validate the pitch, alongside the box dimensions before trying to copy data from the underlying surface. Fixes possible out of bounds reads with cursor snooping.

Source: NVD CVE-2026-99002

References

• https://git.kernel.org/stable/c/073437615a8da528935146ca6a17292c0ca8ce19
• https://git.kernel.org/stable/c/21bc51cb89ced74d6645a138cc2f21184bc75094
• https://git.kernel.org/stable/c/76e5ddd7d9822c8c3492e0f50ba8978e093069ad
• https://git.kernel.org/stable/c/cbf7616464334b217ed07b8adacaed549f2a9433
• https://git.kernel.org/stable/c/db6fbc2b77849e3c3c2bc115ea9ac925c4625a0d
• https://git.kernel.org/stable/c/f54b41644744f72c86e44a21733ac6fc910ca133
• https://git.kernel.org/stable/c/f6d9c8abdf06a9c7efa799532d66ed8d5a50734c
• https://git.kernel.org/stable/c/fcb137f6e7ed769f7ecad84364a33c451371b602

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.