Bug 2419954 (CVE-2025-40277)

Summary:	CVE-2025-40277 kernel: drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	Keywords:	Security
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2025-12-08 07:11:33 UTC

In the Linux kernel, the following vulnerability has been resolved:

drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE

This data originates from userspace and is used in buffer offset
calculations which could potentially overflow causing an out-of-bounds
access.

Comment 1 TEJ RATHI 2025-12-08 13:13:18 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025120717-CVE-2025-40277-d511@gregkh/T

Comment 4 errata-xmlrpc 2026-01-12 09:10:53 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:0453 https://access.redhat.com/errata/RHSA-2026:0453

Comment 6 errata-xmlrpc 2026-01-19 11:41:54 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:0793 https://access.redhat.com/errata/RHSA-2026:0793

Comment 8 errata-xmlrpc 2026-01-21 09:39:43 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Extended Update Support

Via RHSA-2026:0917 https://access.redhat.com/errata/RHSA-2026:0917

Comment 9 errata-xmlrpc 2026-01-26 07:44:09 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:1148 https://access.redhat.com/errata/RHSA-2026:1148

Comment 10 errata-xmlrpc 2026-01-26 13:31:56 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:1142 https://access.redhat.com/errata/RHSA-2026:1142

Comment 11 errata-xmlrpc 2026-01-26 14:09:56 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:1194 https://access.redhat.com/errata/RHSA-2026:1194

Comment 12 errata-xmlrpc 2026-01-26 16:23:35 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:1236 https://access.redhat.com/errata/RHSA-2026:1236

Comment 13 errata-xmlrpc 2026-01-28 00:23:00 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:1443 https://access.redhat.com/errata/RHSA-2026:1443

Comment 14 errata-xmlrpc 2026-01-28 00:27:35 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2026:1445 https://access.redhat.com/errata/RHSA-2026:1445

Comment 15 errata-xmlrpc 2026-01-28 00:29:49 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:1441 https://access.redhat.com/errata/RHSA-2026:1441

Comment 16 errata-xmlrpc 2026-01-28 00:32:47 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.6 Telecommunications Update Service

Via RHSA-2026:1442 https://access.redhat.com/errata/RHSA-2026:1442

Comment 17 errata-xmlrpc 2026-01-28 15:04:27 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

Via RHSA-2026:1495 https://access.redhat.com/errata/RHSA-2026:1495

Comment 18 errata-xmlrpc 2026-01-28 15:08:11 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

Via RHSA-2026:1494 https://access.redhat.com/errata/RHSA-2026:1494

Comment 19 errata-xmlrpc 2026-01-28 19:15:05 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Advanced Update Support

Via RHSA-2026:1512 https://access.redhat.com/errata/RHSA-2026:1512