vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2025-40277

drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE

HIGH
7.8
CVSS Score
Published: December 6, 2025 at 09:51 PM UTC
Updated: October 15, 2026 at 07:10 PM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH7.8
Exploit prediction
EPSS 0.2%
SSVC
No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE This data originates from userspace and is used in buffer offset calculations which could potentially overflow causing an out-of-bounds access.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel· Linux
90%
4.38ce75f8ab9044fe11caaaf2b2c82471023212f9f
Vendor states this is fixed in 32b415a9dc2c212e809b7ebc2b14bc3fbda2b9af (fixed)
Vendor states this is fixed in 54d458b244893e47bda52ec3943fdfbc8d7d068b (fixed)
Vendor states this is fixed in 5aea2cde03d4247cdcf53f9ab7d0747c9dca1cfc (fixed)
Vendor states this is fixed in 709e5c088f9c99a5cf2c1d1c6ce58f2cca7ab173 (fixed)
Vendor states this is fixed in a3abb54c27b2c393c44362399777ad2f6e1ff17e (fixed)
Vendor states this is fixed in b5df9e06eed3df6a4f5c6f8453013b0cabb927b4 (fixed)
Vendor states this is fixed in e58559845021c3bad5e094219378b869157fad53 (fixed)
Vendor states this is fixed in f3f3a8eb3f0ba799fae057091d8c67cca12d6fa0 (fixed)
Vendor states this is fixed in 4.3 (unaffected)
Vendor states this is fixed in 5.10.247 (unaffected)
Vendor states this is fixed in 5.15.197 (unaffected)
Vendor states this is fixed in 5.4.302 (unaffected)
Vendor states this is fixed in 6.1.159 (unaffected)
Vendor states this is fixed in 6.12.59 (unaffected)
Vendor states this is fixed in 6.17.9 (unaffected)
Vendor states this is fixed in 6.18 (unaffected)
Vendor states this is fixed in 6.6.117 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (8)

Source: cverecord
https://git.kernel.org/stable/c/e58559845021c3bad5e094219378b869157fad53
Source: cverecord
https://git.kernel.org/stable/c/54d458b244893e47bda52ec3943fdfbc8d7d068b
Source: cverecord
https://git.kernel.org/stable/c/709e5c088f9c99a5cf2c1d1c6ce58f2cca7ab173
Source: cverecord
https://git.kernel.org/stable/c/a3abb54c27b2c393c44362399777ad2f6e1ff17e
Source: cverecord
https://git.kernel.org/stable/c/b5df9e06eed3df6a4f5c6f8453013b0cabb927b4
Source: cverecord
https://git.kernel.org/stable/c/5aea2cde03d4247cdcf53f9ab7d0747c9dca1cfc
Source: cverecord
https://git.kernel.org/stable/c/f3f3a8eb3f0ba799fae057091d8c67cca12d6fa0
Source: cverecord
https://git.kernel.org/stable/c/32b415a9dc2c212e809b7ebc2b14bc3fbda2b9af

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

7.8HIGHLinux
Vector?

Quick Info

StatusDEFERRED

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card