A lack of input validation in the Linux kernel vmwgfx driver could allow a local attacker with low privileges to achieve privilege escalation or system compromise.

The vmwgfx graphics driver fails to validate the array_size parameter provided by userspace against Shader Model limits. This allows an authenticated local user to potentially cause memory corruption, leading to a loss of confidentiality, integrity, or availability.

While the CVSS score of 7.8 indicates a High severity, the local attack vector limits the initial scope of the threat. However, in multi-user environments or shared hosting platforms, this vulnerability poses a significant risk as a local user could escalate privileges or crash the system, resulting in unauthorized access to sensitive data or service disruption.

Immediate Action: Update the Linux kernel to versions 5.10.265, 5.15.216, 6.1.183, 6.6.148, or later, as provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for kernel-related crashes or segmentation faults, particularly those originating from the vmwgfx driver or graphics subsystem.

Compensating Controls: Restrict access to graphics hardware interfaces for untrusted local users to reduce the attack surface.

Public Exploit Available: No

Given the potential for privilege escalation, organizations should prioritize patching systems that allow local user access. Apply the kernel updates provided by your distribution maintainer at the earliest opportunity to mitigate the risk of local exploitation.