A memory corruption vulnerability in the Linux kernel vmwgfx driver permits local users to achieve potential code execution or system instability by triggering out of bounds memory operations.

The vulnerability involves incorrect assignment of boolean values to the guest_memory_size field within the vmwgfx_resource.c source file. This error causes memory allocation size calculations to fail, leading to zero length or wrap around memory access patterns that read or write past the intended buffer boundaries. An attacker with local access is required to trigger this flaw.

The vulnerability carries a CVSS score of 7.8, indicating a high severity risk. Successful exploitation allows a local user to corrupt kernel memory, which can lead to privilege escalation, unauthorized data access, or a complete system crash. Given the potential for full system compromise, this flaw poses a significant threat to the confidentiality, integrity, and availability of affected Linux systems.

Immediate Action: Update the Linux kernel to version 6.6.151, 6.12.103, 6.18.44, 7.1.8, or later, as provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for kernel oops or panic events that may indicate attempted exploitation of the vmwgfx driver.

Compensating Controls: Restrict local access to systems utilizing the vmwgfx driver and ensure that unprivileged users cannot interact directly with the graphics device interface.

Public Exploit Available: Unknown

The risk posed by this kernel memory corruption is severe for any environment allowing multi user access or untrusted local execution. System administrators should prioritize testing and deploying the provided kernel patches across all affected assets immediately to prevent potential local privilege escalation.