CVE-2026-68446: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-68446 is an input validation vulnerability in the Linux kernel's DRM vmwgfx driver that allows a local user to supply an invalid vmw_surface_metadata::array_size value, potentially causing memory corruption or kernel crashes. The flaw was published on August 12, 2026, and affects Linux kernel versions starting from 5.7 up to (but not including) the fixed stable releases. Fixed versions include 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc5. The CVSS base score is estimated as Medium (0.0 formally assigned at time of publication, with a category estimate of Medium) (GitHub Advisory, Feedly).

The root cause is improper input validation (CWE-20) in the vmwgfx DRM driver: the array_size field within the vmw_surface_metadata structure is supplied from userspace but is not validated against the limits imposed by the available Shader Model (SM) version before being used by the kernel. This allows a local attacker with access to the DRM device to pass an out-of-range array_size value through a DRM ioctl, which the kernel then processes without bounds checking, potentially leading to out-of-bounds memory access or memory corruption. The vulnerability was introduced at commit 504901dbb0b565fcbe466b0c56f3131586df5afd and is fixed by commits 5ff94e127917, 71779fe8bf40, b1379f0c42b8, 6910ccaf4167, and a4f55260f7f7 across the affected stable branches (GitHub Advisory, Feedly).

A local user with access to the DRM device (e.g., a member of the video or render group, or a user in a virtualized environment using VMware graphics) can trigger memory corruption, out-of-bounds memory access, or kernel crashes (denial of service) by supplying a crafted array_size value. In the worst case, memory corruption could be leveraged for local privilege escalation, though no such exploitation has been demonstrated publicly. The impact is limited to the local system; remote exploitation is not possible without prior local access (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the publication date (Feedly). The EPSS score is 0.0, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access to the DRM device, which limits the attack surface primarily to multi-user systems, virtualized environments, or container escapes where DRM device access is granted.

Apply the Linux kernel security updates that include validation of the vmw_surface_metadata::array_size field: upgrade to kernel 6.6.148, 6.12.101, 6.18.42, 7.1.6, or 7.2-rc5 (or later) as appropriate for your distribution (GitHub Advisory). As a workaround, restrict access to DRM device files (e.g., /dev/dri/*) to only trusted users and groups, reducing the attack surface. Monitor systems for unexpected kernel panics or crashes related to vmwgfx driver operations, which may indicate attempted exploitation.