In the Linux kernel, the following vulnerability has been resolved:
drm/vmwgfx: Validate vmw_surface_metadata::array_size
This field comes from userspace and should be validated against specific limits depending on which Shader Model (SM) is available.
References
- https://git.kernel.org/stable/c/5ff94e1279176b539d451e3e754fdcbd1a8d520a
- https://git.kernel.org/stable/c/6910ccaf41678f7761ba2e57d72b77d056320b4d
- https://git.kernel.org/stable/c/71779fe8bf403a9b3e28dc59229fa556db32d35d
- https://git.kernel.org/stable/c/a4f55260f7f7d4dc4d0ee55063dfb0c457b77991
- https://git.kernel.org/stable/c/b1379f0c42b88cb60b9f3757eb5d1e73ad460ed8