In the Linux kernel, the following vulnerability has been resolved:
drm/vmwgfx: Fix a null-ptr access in the cursor snooper
Check that the resource which is converted to a surface exists before trying to use the cursor snooper on it.
vmwcmdrescheck allows explicit invalid (SVGA3DINVALIDID) identifiers because some svga commands accept SVGA3DINVALIDID to mean "no surface", unfortunately functions that accept the actual surfaces as objects might (and in case of the cursor snooper, do not) be able to handle null objects. Make sure that we validate not only the identifier (via the vmwcmdrescheck) but also check that the actual resource exists before trying to do something with it.
Fixes unchecked null-ptr reference in the snooping code.
[
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"187925284145641526558784152271947177390",
"86950890619945903287050897306697567110",
"143083642571568747615222436037682228276",
"49531268596806437713620508925816124328",
"114003008929792212629240195874470195317",
"69403645379352883749138612721776848842",
"335903530774615933431380068017015740581",
"149381474505325579382169811431952179323",
"139370767491013341382139622399226439100",
"152179269152517901736147930834399801367",
"245015144890124066230214859474151238453",
"4873950116561413619052938881600042571",
"56470759609951947983759021687396409042",
"194090824142501585591281961956439461508",
"239395611243692392253149076965307364461",
"339322350634893265713752171319174774263",
"336477802012833924061331098868007219419"
]
},
"id": "CVE-2025-40110-200dea63",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b6fca0a07989f361ceda27cb2d09c555d4d4a964",
"target": {
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"187925284145641526558784152271947177390",
"86950890619945903287050897306697567110",
"143083642571568747615222436037682228276",
"49531268596806437713620508925816124328",
"114003008929792212629240195874470195317",
"69403645379352883749138612721776848842",
"335903530774615933431380068017015740581",
"149381474505325579382169811431952179323",
"139370767491013341382139622399226439100",
"152179269152517901736147930834399801367",
"245015144890124066230214859474151238453",
"4873950116561413619052938881600042571",
"56470759609951947983759021687396409042",
"194090824142501585591281961956439461508",
"239395611243692392253149076965307364461",
"339322350634893265713752171319174774263",
"336477802012833924061331098868007219419"
]
},
"id": "CVE-2025-40110-2ce3eb02",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@13c9e4ed125e19484234c960efe5ac9c55119523",
"target": {
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "330319054137251741997766511433963493504",
"length": 1357.0
},
"id": "CVE-2025-40110-427f765b",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@13c9e4ed125e19484234c960efe5ac9c55119523",
"target": {
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c",
"function": "vmw_cmd_dma"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"187925284145641526558784152271947177390",
"86950890619945903287050897306697567110",
"143083642571568747615222436037682228276",
"49531268596806437713620508925816124328",
"114003008929792212629240195874470195317",
"69403645379352883749138612721776848842",
"335903530774615933431380068017015740581",
"149381474505325579382169811431952179323",
"139370767491013341382139622399226439100",
"152179269152517901736147930834399801367",
"245015144890124066230214859474151238453",
"4873950116561413619052938881600042571",
"56470759609951947983759021687396409042",
"194090824142501585591281961956439461508",
"239395611243692392253149076965307364461",
"339322350634893265713752171319174774263",
"336477802012833924061331098868007219419"
]
},
"id": "CVE-2025-40110-594e9442",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5ac2c0279053a2c5265d46903432fb26ae2d0da2",
"target": {
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "330319054137251741997766511433963493504",
"length": 1357.0
},
"id": "CVE-2025-40110-6e3cfccd",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5ac2c0279053a2c5265d46903432fb26ae2d0da2",
"target": {
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c",
"function": "vmw_cmd_dma"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "330319054137251741997766511433963493504",
"length": 1357.0
},
"id": "CVE-2025-40110-cc9afd24",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b6fca0a07989f361ceda27cb2d09c555d4d4a964",
"target": {
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c",
"function": "vmw_cmd_dma"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"187925284145641526558784152271947177390",
"86950890619945903287050897306697567110",
"143083642571568747615222436037682228276",
"49531268596806437713620508925816124328",
"114003008929792212629240195874470195317",
"69403645379352883749138612721776848842",
"335903530774615933431380068017015740581",
"149381474505325579382169811431952179323",
"139370767491013341382139622399226439100",
"152179269152517901736147930834399801367",
"245015144890124066230214859474151238453",
"4873950116561413619052938881600042571",
"56470759609951947983759021687396409042",
"194090824142501585591281961956439461508",
"239395611243692392253149076965307364461",
"339322350634893265713752171319174774263",
"336477802012833924061331098868007219419"
]
},
"id": "CVE-2025-40110-f08ed4ca",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@299cfb5a7deabdf9ecd30071755672af0aced5eb",
"target": {
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "330319054137251741997766511433963493504",
"length": 1357.0
},
"id": "CVE-2025-40110-ffb9db98",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@299cfb5a7deabdf9ecd30071755672af0aced5eb",
"target": {
"file": "drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c",
"function": "vmw_cmd_dma"
}
}
]