There is an UAF vulnerability in vmwgfx driver

Published 4 y ago 2022-09-09 · modified 4 mo ago 2026-06-17 · JSON

CVSS

6.3

v3.1 · CNA

CISA KEV

not known exploited

EPSS

0.6%

percentile 48%

Public exploits

none known

A use-after-free(UAF) vulnerability was found in function 'vmw_cmd_res_check' in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in Linux kernel's vmwgfx driver with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing a denial of service(DoS).

Exploit prediction (EPSS)

0.57% probability of exploitation in the next 30 days, higher than 48% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	3.1	6.3	`CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:H`
CNA	3.1	6.3	`CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:H`
NVD	3.1	5.5	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H`

Affected products

Linux kernel

Classification

Weakness

CWE-416 Use After Free

Technology feeds

Linux kernel (RSS, critical only)

References

bugzilla.openanolis.cn /show_bug.cgi?id=2074 · x_refsource_MISC, x_transferred

Sources

CVE List: CVE-2022-38457
NVD: CVE-2022-38457

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.