CVE-2026-23008

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23008", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:45.939Z", "datePublished": "2026-01-25T14:36:21.933Z", "dateUpdated": "2026-11-05T21:23:15.274Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T21:58:13.228Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: Fix KMS with 3D on HW version 10\n\nHW version 10 does not have GB Surfaces so there is no backing buffer for\nsurface backed FBs. This would result in a nullptr dereference and crash\nthe driver causing a black screen."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/vmwgfx/vmwgfx_kms.c"], "versions": [{"version": "965544150d1cadf0e8f5bb6c13c19697e46e1429", "lessThan": "a91bdd21d5efb3072beefbec13762b7722200c49", "status": "affected", "versionType": "git"}, {"version": "965544150d1cadf0e8f5bb6c13c19697e46e1429", "lessThan": "d9186faeae6efb7d0841a5e8eb213ff4c7966614", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/vmwgfx/vmwgfx_kms.c"], "versions": [{"version": "6.16", "status": "affected"}, {"version": "0", "lessThan": "6.16", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.7", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.18.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.19"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/a91bdd21d5efb3072beefbec13762b7722200c49"}, {"url": "https://git.kernel.org/stable/c/d9186faeae6efb7d0841a5e8eb213ff4c7966614"}], "title": "drm/vmwgfx: Fix KMS with 3D on HW version 10", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23008", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T21:18:29.578795Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:23:15.274Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23008", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T21:18:29.578795Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:18:30.779Z"}}], "cna": {"title": "drm/vmwgfx: Fix KMS with 3D on HW version 10", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "965544150d1cadf0e8f5bb6c13c19697e46e1429", "lessThan": "a91bdd21d5efb3072beefbec13762b7722200c49", "versionType": "git"}, {"status": "affected", "version": "965544150d1cadf0e8f5bb6c13c19697e46e1429", "lessThan": "d9186faeae6efb7d0841a5e8eb213ff4c7966614", "versionType": "git"}], "programFiles": ["drivers/gpu/drm/vmwgfx/vmwgfx_kms.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.16"}, {"status": "unaffected", "version": "0", "lessThan": "6.16", "versionType": "semver"}, {"status": "unaffected", "version": "6.18.7", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/gpu/drm/vmwgfx/vmwgfx_kms.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/a91bdd21d5efb3072beefbec13762b7722200c49"}, {"url": "https://git.kernel.org/stable/c/d9186faeae6efb7d0841a5e8eb213ff4c7966614"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: Fix KMS with 3D on HW version 10\n\nHW version 10 does not have GB Surfaces so there is no backing buffer for\nsurface backed FBs. This would result in a nullptr dereference and crash\nthe driver causing a black screen."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.7", "versionStartIncluding": "6.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.19", "versionStartIncluding": "6.16"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T21:58:13.228Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23008", "state": "PUBLISHED", "dateUpdated": "2026-11-05T21:23:15.274Z", "dateReserved": "2026-01-13T15:37:45.939Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-01-25T14:36:21.933Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/vmwgfx/vmwgfx_kms.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "a91bdd21d5efb3072beefbec13762b7722200c49", "status": "affected", "version": "965544150d1cadf0e8f5bb6c13c19697e46e1429", "versionType": "git"}, {"lessThan": "d9186faeae6efb7d0841a5e8eb213ff4c7966614", "status": "affected", "version": "965544150d1cadf0e8f5bb6c13c19697e46e1429", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/vmwgfx/vmwgfx_kms.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.16"}, {"lessThan": "6.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.19", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "93EB4FA7-6AD6-4923-B7A8-9F5B3940F93F", "versionEndExcluding": "6.18.7", "versionStartIncluding": "6.16.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:-:*:*:*:*:*:*", "matchCriteriaId": "6238B17D-C12B-458F-A138-97039BFC4595", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*", "matchCriteriaId": "17B67AA7-40D6-4AFA-8459-F200F3D7CFD1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*", "matchCriteriaId": "C47E4CC9-C826-4FA9-B014-7FE3D9B318B2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*", "matchCriteriaId": "F71D92C0-C023-48BD-B3B6-70B638EEE298", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*", "matchCriteriaId": "13580667-0A98-40CC-B29F-D12790B91BDB", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*", "matchCriteriaId": "CAD1FED7-CF48-47BF-AC7D-7B6FA3C065FC", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*", "matchCriteriaId": "3EF854A1-ABB1-4E93-BE9A-44569EC76C0D", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc7:*:*:*:*:*:*", "matchCriteriaId": "F5DC0CA6-F0AF-4DDF-A882-3DADB9A886A7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc8:*:*:*:*:*:*", "matchCriteriaId": "EB5B7DFC-C36B-45D8-922C-877569FDDF43", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: Fix KMS with 3D on HW version 10\n\nHW version 10 does not have GB Surfaces so there is no backing buffer for\nsurface backed FBs. This would result in a nullptr dereference and crash\nthe driver causing a black screen."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndrm/vmwgfx: Corregir KMS con 3D en la versi\u00f3n de HW 10\n\nLa versi\u00f3n de HW 10 no tiene GB Surfaces por lo que no hay un b\u00fafer de respaldo para FBs respaldados por superficie. Esto resultar\u00eda en una desreferencia de puntero nulo y colapsar\u00eda el controlador causando una pantalla negra."}], "id": "CVE-2026-23008", "lastModified": "2026-11-05T22:17:59.797", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23008", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T21:18:29.578795Z", "version": "2.0.3"}}]}, "published": "2026-01-25T15:15:55.673", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a91bdd21d5efb3072beefbec13762b7722200c49"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d9186faeae6efb7d0841a5e8eb213ff4c7966614"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: drm/vmwgfx: Fix KMS with 3D on HW version 10", "id": "2432675", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2432675"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2026-23008", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-01-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-23008\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23008\nhttps://lore.kernel.org/linux-cve-announce/2026012537-CVE-2026-23008-d435@gregkh/T"], "threat_severity": "Low"}

{"analysis": {"en": {"generated_at": "2026-04-18T02:51:19.446700+00:00", "value": {"mitigation_remediation": ["Upgrade the Linux kernel to the latest release that incorporates the vmwgfx patch addressing CVE\u20112026\u201123008", "If an upgrade is not feasible, disable or avoid using 3D KMS features on hardware identified as version\u202f10 to prevent the creation of affected surface\u2011backed framebuffers", "Verify kernel configuration to ensure that the vmwgfx driver is correctly compiled and that no unintended framebuffer allocations are performed on HW version\u202f10 devices"], "summary": {"action": "Immediate Patch", "impact": "Denial of Service via driver crash (null pointer dereference with 3D KMS on HW version 10)"}, "threat_synthesis": {"affected_systems": "All Linux kernel deployments that include the vmwgfx DRM driver, notably kernel 6.16 and all 6.19 release candidate series, are affected. The vulnerability applies to environments where the hardware presents a version 10 identifier and expects 3D KMS support.", "description_and_impact": "The vmwgfx driver in the Linux kernel contains a bug that results in a null pointer dereference when a 3D KMS framebuffer is created on hardware version 10, which does not provide GB surfaces or a backing buffer. The kernel crash triggers a black screen and disrupts graphics operations, effectively denying service to applications using 3D graphics. This flaw is identified as CWE\u2011476 and does not provide a path to arbitrary code execution, but it can be exploited locally by any process that can request the vulnerable framebuffer configuration.", "risk_and_exploitability": "With a CVSS score of 5.5, the risk is considered medium, while the EPSS score of less than 1\u202f% indicates a very low probability of current exploitation. The vulnerability is not listed in the CISA KEV catalog, further supporting the assessment that widespread attacks are unlikely. Attackers would need local access or the ability to influence framebuffer creation on HW version\u202f10 hardware to trigger the crash; remote exploitation or privilege escalation is not possible based on the provided data."}}}}, "created": "2026-04-18T03:00:10.326283+00:00", "updated": "2026-04-18T03:00:10.326293+00:00", "vendors": []}