drm/vmwgfx: drop dma_buf reference on foreign-fd prime import
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: drop dma_buf reference on foreign-fd prime import ttm_prime_fd_to_handle() returns -ENOSYS when the imported fd's dma_buf->ops do not match the ttm_object_device's ops, but does so without releasing the reference acquired by dma_buf_get(). Any unprivileged renderD client passing a non-vmwgfx prime fd through the DRM_VMW_GB_SURFACE_REF{,_EXT} path leaks one dma_buf reference per call and indefinitely pins the foreign exporter's GEM resources. Funnel the error path through the existing dma_buf_put() so the reference is always dropped.
- Products
- Kernel
- Affected versions
- Not specified
- Fixed versions
- 5.10.270, 5.15.221, 6.1.183, 6.12.103, 6.18.44, 6.6.151, 7.1.8
- CVEs
- CVE-2026-80888
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 08:43 UTC · Revision 1
Source evidence
drm/vmwgfx: drop dma_buf reference on foreign-fd prime import
core-osv · Original sourcePublished 4 Sept 2026, 17:11 UTC
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: drop dma_buf reference on foreign-fd prime import ttm_prime_fd_to_handle() returns -ENOSYS when the imported fd's dma_buf->ops do not match the ttm_object_device's ops, but does so without releasing the reference acquired by dma_buf_get(). Any unprivileged renderD client passing a non-vmwgfx prime fd through the DRM_VMW_GB_SURFACE_REF{,_EXT} path leaks one dma_buf reference per call and indefinitely pins the foreign exporter's GEM resources. Funnel the error path through the existing dma_buf_put() so the reference is always dropped.
osv:CVE-2026-80888
Kernel
Fixed versions: 5.10.270, 5.15.221, 6.1.183, 6.6.151, 6.12.103, 6.18.44, 7.1.8
Complete source record
{
"id": "32e3ebe994bf3428a4562a511b3ffbe0bffc2ed559640ebe0a4b46d87ba114dc",
"url": "https://osv.dev/vulnerability/CVE-2026-80888",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "drm/vmwgfx: drop dma_buf reference on foreign-fd prime import",
"summary": "In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: drop dma_buf reference on foreign-fd prime import ttm_prime_fd_to_handle() returns -ENOSYS when the imported fd's dma_buf->ops do not match the ttm_object_device's ops, but does so without releasing the reference acquired by dma_buf_get(). Any unprivileged renderD client passing a non-vmwgfx prime fd through the DRM_VMW_GB_SURFACE_REF{,_EXT} path leaks one dma_buf reference per call and indefinitely pins the foreign exporter's GEM resources. Funnel the error path through the existing dma_buf_put() so the reference is always dropped.",
"evidence": "osv:CVE-2026-80888",
"products": [
{
"name": {
"value": "Kernel",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "5.10.270",
"evidence": "/affected/1/ranges"
},
{
"value": "5.15.221",
"evidence": "/affected/1/ranges"
},
{
"value": "6.1.183",
"evidence": "/affected/1/ranges"
},
{
"value": "6.6.151",
"evidence": "/affected/1/ranges"
},
{
"value": "6.12.103",
"evidence": "/affected/1/ranges"
},
{
"value": "6.18.44",
"evidence": "/affected/1/ranges"
},
{
"value": "7.1.8",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "CVE-2026-80888",
"aliases": [
"CVE-2026-80888"
],
"affected": [
{
"ranges": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "65981f7681abdf92b25942222b629b9c512d0705"
},
{
"fixed": "1715901e7052cf90fbf04c8303e563a47e021278"
},
{
"fixed": "c4fd91ee7228f56fbb4cf528757dc17ffefeb0ee"
},
{
"fixed": "619c3cfa88e09603a13d918f754808db2dda7057"
},
{
"fixed": "c1c22fca0a0896a452a7cb92422d67babd65b4be"
},
{
"fixed": "a1e972fa94c3a8069e022c67b9d97c7aa7b05293"
},
{
"fixed": "a8434b145b1e467940334c58c00af241e9494c5f"
},
{
"fixed": "4df39eb99bb47d1f24d1952c23b21b10988356bf"
},
{
"fixed": "f739416dc555fa205a785e5135d73fa39b26f35d"
}
]
}
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80888.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.13.0"
},
{
"fixed": "5.10.270"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.11.0"
},
{
"fixed": "5.15.221"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.16.0"
},
{
"fixed": "6.1.183"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.2.0"
},
{
"fixed": "6.6.151"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.7.0"
},
{
"fixed": "6.12.103"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.13.0"
},
{
"fixed": "6.18.44"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.19.0"
},
{
"fixed": "7.1.8"
}
]
}
],
"package": {
"name": "Kernel",
"ecosystem": "Linux"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80888.json"
}
}
],
"modified": "2026-10-28T02:30:27.113154927Z",
"provider": "osv",
"references": [
"https://git.kernel.org/stable/c/1715901e7052cf90fbf04c8303e563a47e021278",
"https://git.kernel.org/stable/c/4df39eb99bb47d1f24d1952c23b21b10988356bf",
"https://git.kernel.org/stable/c/619c3cfa88e09603a13d918f754808db2dda7057",
"https://git.kernel.org/stable/c/a1e972fa94c3a8069e022c67b9d97c7aa7b05293",
"https://git.kernel.org/stable/c/a8434b145b1e467940334c58c00af241e9494c5f",
"https://git.kernel.org/stable/c/c1c22fca0a0896a452a7cb92422d67babd65b4be",
"https://git.kernel.org/stable/c/c4fd91ee7228f56fbb4cf528757dc17ffefeb0ee",
"https://git.kernel.org/stable/c/f739416dc555fa205a785e5135d73fa39b26f35d",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80888.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-80888",
"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
],
"provider_metadata": {
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80888.json"
}
},
"related_cves": [
{
"value": "CVE-2026-80888",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 493935,
"published_at": "2026-09-04T17:11:04.975+00:00"
}