{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.105-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.8-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux-6.12"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.107-1~deb12u1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  drm/vmwgfx: validate external BO copy bounds for both stride paths  vmw_external_bo_copy() trusts caller-supplied offsets, strides, and heights and operates on imported dma-buf vmaps:    - The equal-stride memcpy() bound was clamped after subtracting the     offsets from dst_size and src_size; an offset larger than the BO     size wraps the unsigned subtraction to a huge value and the     resulting memcpy() runs off the end of the vmap.  dst_stride *     height is also a u32 multiplication that can overflow.   - The non-equal-stride row-by-row path had no bound at all.  The     loop touches bytes through offset + (height - 1) * stride +     width_in_bytes, with only a WARN_ON(dst_stride \u003c width_in_bytes),     and could likewise step past the end of either mapping.  The offsets and strides are derived from STDU/SOU plane state, so a configured CRTC submitting a crafted atomic commit on an imported framebuffer can reach this path.  Validate the exact row-copy endpoint against each BO's size up front using check_mul_overflow() and check_add_overflow().  Use the bulk memcpy() path only when width_in_bytes covers the whole stride; otherwise copy one row at a time so partial-row updates near the bottom of a framebuffer remain valid.  Also reject zero strides and stride \u003c width_in_bytes, both of which the row-by-row path cannot represent safely.",
  "id": "DEBIAN-CVE-2026-80700",
  "modified": "2026-09-19T21:47:23.775618619Z",
  "published": "2026-08-28T08:16:55.517Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-80700"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-80700"
  ]
}