CVE-2022-50440
published 2025-10-01CVE-2022-50440: In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Validate the box size for the snooped cursor Invalid userspace dma surface…
PriorityP418medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.16%
5.3th percentile
In the Linux kernel, the following vulnerability has been resolved:
drm/vmwgfx: Validate the box size for the snooped cursor
Invalid userspace dma surface copies could potentially overflow
the memcpy from the surface to the snooped image leading to crashes.
To fix it the dimensions of the copybox have to be validated
against the expected size of the snooped cursor.
Affected
23 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.4-1 (bookworm) | linux 6.1.4-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 2ac863719e518ae1a8f328849e64ea26a222f079 < ee8d31836cbe7c26e207bfa0a4a726f0a25cfcf6 | ee8d31836cbe7c26e207bfa0a4a726f0a25cfcf6 |
| linux | linux | >= 2ac863719e518ae1a8f328849e64ea26a222f079 < 50d177f90b63ea4138560e500d92be5e4c928186 | 50d177f90b63ea4138560e500d92be5e4c928186 |
| linux | linux | >= 2ac863719e518ae1a8f328849e64ea26a222f079 < 6b4e70a428b5a11f56db94047b68e144529fe512 | 6b4e70a428b5a11f56db94047b68e144529fe512 |
| linux | linux | >= 2ac863719e518ae1a8f328849e64ea26a222f079 < 94b283341f9f3f0ed56a360533766377a01540e0 | 94b283341f9f3f0ed56a360533766377a01540e0 |
| linux | linux | >= 2ac863719e518ae1a8f328849e64ea26a222f079 < 439cbbc1519547f9a7b483f0de33b556ebfec901 | 439cbbc1519547f9a7b483f0de33b556ebfec901 |
| linux | linux | >= 2ac863719e518ae1a8f328849e64ea26a222f079 < 6948e570f54f2044dd4da444b10471373a047eeb | 6948e570f54f2044dd4da444b10471373a047eeb |
| linux | linux | >= 2ac863719e518ae1a8f328849e64ea26a222f079 < 4d54d11b49860686331c58a00f733b16a93edfc4 | 4d54d11b49860686331c58a00f733b16a93edfc4 |
| linux | linux | >= 2ac863719e518ae1a8f328849e64ea26a222f079 < 622d527decaac0eb65512acada935a0fdc1d0202 | 622d527decaac0eb65512acada935a0fdc1d0202 |
| linux | linux | >= 2ac863719e518ae1a8f328849e64ea26a222f079 < 4cf949c7fafe21e085a4ee386bb2dade9067316e | 4cf949c7fafe21e085a4ee386bb2dade9067316e |
| linux | linux_kernel | >= 0 < 5.10.178-1 | 5.10.178-1 |
| linux | linux_kernel | >= 0 < 6.1.4-1 | 6.1.4-1 |
| linux | linux_kernel | >= 0 < 6.1.4-1 | 6.1.4-1 |
| linux | linux_kernel | >= 0 < 6.1.4-1 | 6.1.4-1 |
| linux | linux_kernel | >= 3.2 < 4.9.337 | 4.9.337 |
| linux | linux_kernel | >= 4.10 < 4.14.303 | 4.14.303 |
| linux | linux_kernel | >= 4.15 < 4.19.270 | 4.19.270 |
| linux | linux_kernel | >= 4.20 < 5.4.229 | 5.4.229 |
| linux | linux_kernel | >= 5.11 < 5.15.87 | 5.15.87 |
| linux | linux_kernel | >= 5.16 < 6.0.18 | 6.0.18 |
| linux | linux_kernel | >= 5.5 < 5.10.163 | 5.10.163 |
| linux | linux_kernel | >= 6.1 < 6.1.4 | 6.1.4 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: Linux kernel: Denial of Service in vmwgfx due to invalid DMA surface copies
vendor_redhat·2025-10-01·CVSS 5.5
CVE-2022-50440 [MEDIUM] CWE-119 kernel: Linux kernel: Denial of Service in vmwgfx due to invalid DMA surface copies
kernel: Linux kernel: Denial of Service in vmwgfx due to invalid DMA surface copies
In the Linux kernel, the following vulnerability has been resolved:
drm/vmwgfx: Validate the box size for the snooped cursor
Invalid userspace dma surface copies could potentially overflow
the memcpy from the surface to the snooped image leading to crashes.
To fix it the dimensions of the copybox have to be validated
against the expected size of the snooped cursor.
A flaw was discovered in the Linux kernel’s DRM vmwgfx driver related to how cursor images are snooped and copied. When the dimensions of a DMA surface copybox were derived from untrusted userspace data without proper validation against the expected snooped cursor size, an invalid size could cause an oversized memcpy operation. This may lead to
Debian
CVE-2022-50440: linux - In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx:...
vendor_debian·2022·CVSS 5.5
CVE-2022-50440 [MEDIUM] CVE-2022-50440: linux - In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx:...
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Validate the box size for the snooped cursor Invalid userspace dma surface copies could potentially overflow the memcpy from the surface to the snooped image leading to crashes. To fix it the dimensions of the copybox have to be validated against the expected size of the snooped cursor.
Scope: local
bookworm: resolved (fixed in 6.1.4-1)
bullseye: resolved (fixed in 5.10.178-1)
forky: resolved (fixed in 6.1.4-1)
sid: resolved (fixed in 6.1.4-1)
trixie: resolved (fixed in 6.1.4-1)
GHSA
GHSA-rvwq-h638-7j7w: In the Linux kernel, the following vulnerability has been resolved:
drm/vmwgfx: Validate the box size for the snooped cursor
Invalid userspace dma s
ghsa_unreviewed·2025-10-01
CVE-2022-50440 [MEDIUM] CWE-476 GHSA-rvwq-h638-7j7w: In the Linux kernel, the following vulnerability has been resolved:
drm/vmwgfx: Validate the box size for the snooped cursor
Invalid userspace dma s
In the Linux kernel, the following vulnerability has been resolved:
drm/vmwgfx: Validate the box size for the snooped cursor
Invalid userspace dma surface copies could potentially overflow
the memcpy from the surface to the snooped image leading to crashes.
To fix it the dimensions of the copybox have to be validated
against the expected size of the snooped cursor.
OSV
CVE-2022-50440: In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Validate the box size for the snooped cursor Invalid userspace dma sur
osv·2025-10-01·CVSS 5.5
CVE-2022-50440 [MEDIUM] CVE-2022-50440: In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Validate the box size for the snooped cursor Invalid userspace dma sur
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Validate the box size for the snooped cursor Invalid userspace dma surface copies could potentially overflow the memcpy from the surface to the snooped image leading to crashes. To fix it the dimensions of the copybox have to be validated against the expected size of the snooped cursor.
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/439cbbc1519547f9a7b483f0de33b556ebfec901https://git.kernel.org/stable/c/4cf949c7fafe21e085a4ee386bb2dade9067316ehttps://git.kernel.org/stable/c/4d54d11b49860686331c58a00f733b16a93edfc4https://git.kernel.org/stable/c/50d177f90b63ea4138560e500d92be5e4c928186https://git.kernel.org/stable/c/622d527decaac0eb65512acada935a0fdc1d0202https://git.kernel.org/stable/c/6948e570f54f2044dd4da444b10471373a047eebhttps://git.kernel.org/stable/c/6b4e70a428b5a11f56db94047b68e144529fe512https://git.kernel.org/stable/c/94b283341f9f3f0ed56a360533766377a01540e0https://git.kernel.org/stable/c/ee8d31836cbe7c26e207bfa0a4a726f0a25cfcf6
2025-10-01
Published