This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] VMware graphics driver in the Linux kernel contains a high-severity vulnerability
The Linux kernel fixes a high-severity vulnerability in versions 6.1.167, 6.6.130, 6.12.77, 6.18.17 and 6.19.7. Information on the individual commits containing the fix can be found at [1]. For common Linux distributions such as Debian [2], Ubuntu [3] or Red Hat [4] and their stable releases, fixes have not been released yet, or the given system is not affected by the vulnerability.
An authenticated local attacker can, due to improper handling of an error condition in the graphics driver (vmwgfx) used in VMware virtual machines, cause the system to work with an uninitialized pointer and subsequently read or write outside the allocated kernel memory region [1]. The vulnerability affects environments where Linux runs as a guest in VMware virtualization (with 3D acceleration enabled) [4].
The vulnerability is present in product:
- Linux; >=6.1, <6.1.167; >=6.2, <=6.2.16; >=6.6, <6.6.130; >=6.12, <6.12.77; >=6.18, <6.18.17; >=6.19, <6.19.7;
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2026-23317 at cve.org, NVD
- CWE-457: Use of Uninitialized Variable at cwe.mitre.org
The vulnerability was publicly disclosed 25. 3. 2026.
Links
By CESNET, z.s.p.o. Michaela Ručková on 21. 4. 2026.