In the Linux kernel, the following vulnerability has been resolved:

drm/vmwgfx: Validate the box size for the snooped cursor

Invalid userspace dma surface copies could potentially overflow
the memcpy from the surface to the snooped image leading to crashes.
To fix it the dimensions of the copybox have to be validated
against the expected size of the snooped cursor.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00156.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
2ac863719e518ae1a8f328849e64ea26a222f079 affected < ee8d31836cbe7c26e207bfa0a4a726f0a25cfcf6
2ac863719e518ae1a8f328849e64ea26a222f079 affected < 50d177f90b63ea4138560e500d92be5e4c928186
2ac863719e518ae1a8f328849e64ea26a222f079 affected < 6b4e70a428b5a11f56db94047b68e144529fe512
2ac863719e518ae1a8f328849e64ea26a222f079 affected < 94b283341f9f3f0ed56a360533766377a01540e0
2ac863719e518ae1a8f328849e64ea26a222f079 affected < 439cbbc1519547f9a7b483f0de33b556ebfec901
2ac863719e518ae1a8f328849e64ea26a222f079 affected < 6948e570f54f2044dd4da444b10471373a047eeb
2ac863719e518ae1a8f328849e64ea26a222f079 affected < 4d54d11b49860686331c58a00f733b16a93edfc4
2ac863719e518ae1a8f328849e64ea26a222f079 affected < 622d527decaac0eb65512acada935a0fdc1d0202
2ac863719e518ae1a8f328849e64ea26a222f079 affected < 4cf949c7fafe21e085a4ee386bb2dade9067316e
Linux Linux affected
Version Status Constraints
3.2 affected —
0 unaffected < 3.2
4.9.337 unaffected ≤ 4.9.*
4.14.303 unaffected ≤ 4.14.*
4.19.270 unaffected ≤ 4.19.*
5.4.229 unaffected ≤ 5.4.*
5.10.163 unaffected ≤ 5.10.*
5.15.87 unaffected ≤ 5.15.*
6.0.18 unaffected ≤ 6.0.*
6.1.4 unaffected ≤ 6.1.*
6.2 unaffected ≤ *

Configuration 1 [-]

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
Linux Subscribe
Linux Kernel Subscribe

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/439cbbc1519547f9a7b483f0de33b556ebfec901 cve-icon cve-icon cve-icon
https://git.kernel.org/stable/c/4cf949c7fafe21e085a4ee386bb2dade9067316e cve-icon cve-icon cve-icon
https://git.kernel.org/stable/c/4d54d11b49860686331c58a00f733b16a93edfc4 cve-icon cve-icon cve-icon
https://git.kernel.org/stable/c/50d177f90b63ea4138560e500d92be5e4c928186 cve-icon cve-icon cve-icon
https://git.kernel.org/stable/c/622d527decaac0eb65512acada935a0fdc1d0202 cve-icon cve-icon cve-icon
https://git.kernel.org/stable/c/6948e570f54f2044dd4da444b10471373a047eeb cve-icon cve-icon cve-icon
https://git.kernel.org/stable/c/6b4e70a428b5a11f56db94047b68e144529fe512 cve-icon cve-icon cve-icon
https://git.kernel.org/stable/c/94b283341f9f3f0ed56a360533766377a01540e0 cve-icon cve-icon cve-icon
https://git.kernel.org/stable/c/ee8d31836cbe7c26e207bfa0a4a726f0a25cfcf6 cve-icon cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2022-50440 cve-icon
https://www.cve.org/CVERecord?id=CVE-2022-50440 cve-icon
History

Tue, 04 Aug 2026 09:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

 cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Wed, 21 Jan 2026 21:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-476
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

Thu, 02 Oct 2025 09:00:00 +0000

Type Values Removed Values Added
First Time appeared Linux
Linux linux Kernel
Vendors & Products Linux
Linux linux Kernel

Thu, 02 Oct 2025 00:15:00 +0000

Type Values Removed Values Added
References

Wed, 01 Oct 2025 12:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Validate the box size for the snooped cursor Invalid userspace dma surface copies could potentially overflow the memcpy from the surface to the snooped image leading to crashes. To fix it the dimensions of the copybox have to be validated against the expected size of the snooped cursor.
Title drm/vmwgfx: Validate the box size for the snooped cursor
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-04T09:09:06.538Z

Reserved: 2025-09-17T14:53:07.010Z

Link: CVE-2022-50440

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Analyzed

Published: 2025-10-01T12:15:36.133

Modified: 2026-06-17T05:23:33.710

Link: CVE-2022-50440

cve-icon Redhat

Severity :

Publid Date: 2025-10-01T11:42:16Z

Links: CVE-2022-50440 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2025-10-02T08:39:54Z

Weaknesses