Out-of-bounds Read in Linux Kernel drm/vmwgfx Fence Events

A local low-privileged attacker may obtain memory beyond the intended DRM fence-event structure, potentially disclosing sensitive kernel-memory contents such as addresses, cryptographic material, or other process and kernel data. Leaked addresses may facilitate bypass of address-space layout randomization in subsequent attacks. The invalid read can also destabilize the kernel and cause a denial of service. The reported CVSS v3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H, with a base score of 7.1.

No vendor-provided workaround is identified beyond applying the corrected kernel. Until patching is complete, restrict local access to systems using the VMware graphics driver, limit access to DRM device interfaces to trusted users and processes, and disable or avoid loading vmwgfx where it is not operationally required. Reboot after installing kernel updates.

Install a Linux kernel update containing the drm/vmwgfx fence-event length correction, then reboot so the updated kernel is active. Red Hat fixes are available through the relevant RHEL 8, RHEL 9, RHEL 9.2 Extended Update Support, and RHEL 9.4 Extended Update Support kernel advisories. SUSE provides the correction in its SUSE Linux Enterprise 15 SP5 kernel security update. RHEL 10 is not affected because the vulnerable code is absent.