FlawAtlas
Search the atlas
CVE-2026-23317 Not scored

drm/vmwgfx: Return the correct value in vmw_translate_ptr functions

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Return the correct value in vmw_translate_ptr functions Before the referenced fixes these functions used a lookup function that returned a pointer. This was changed to another lookup function that returned an error code with the pointer becoming an out parameter. The error path when the lookup failed was not changed to reflect this change and the code continued to return the PTR_ERR of the now uninitialized pointer. This could cause the vmw_translate_ptr functions to return success when they actually failed causing further uninitialized and OOB accesses.

Exploit probability 0.1%
Published March 25, 2026
Required by Not available
Last source change July 15, 2026

02 / AFFECTED SOFTWARE

Affected packages

Linux Kernel
Unknown Unknown

160 explicit affected versions

03 / CONNECTIONS

Connected vulnerabilities

related OPENSUSE-SU-2026:20826-1
related SUSE-SU-2026:1573-1
related SUSE-SU-2026:1574-1
related SUSE-SU-2026:1606-1
related SUSE-SU-2026:1643-1
related SUSE-SU-2026:1661-1
related SUSE-SU-2026:21114-1
related SUSE-SU-2026:21123-1
related SUSE-SU-2026:21255-1
related SUSE-SU-2026:2134-1
related SUSE-SU-2026:2149-1
related SUSE-SU-2026:2159-1
related SUSE-SU-2026:2172-1
related SUSE-SU-2026:2176-1
related SUSE-SU-2026:2181-1
related SUSE-SU-2026:21841-1
related SUSE-SU-2026:21845-1
related SUSE-SU-2026:21860-1
related SUSE-SU-2026:2199-1

04 / EVIDENCE

Source records

Open Source Vulnerabilities CVE-2026-23317

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Return the correct value in vmw_translate_ptr functions Before the referenced fixes these functions used a lookup function that returned a pointer. This was changed to another lookup function that returned an error code with the pointer becoming an out parameter. The error path when the lookup failed was not changed to reflect this change and the code continued to return the PTR_ERR of the now uninitialized pointer. This could cause the vmw_translate_ptr functions to return success when they actually failed causing further uninitialized and OOB accesses.

View original source

05 / REFERENCES

Further evidence