{
  "cveId": "CVE-2026-99002",
  "url": "https://patchblox.com/security/cve/CVE-2026-99002",
  "summary": "CVE-2026-99002 is fixed in linux on 1 platform, first by DEBIAN-CVE-2026-99002, released October 24, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "drm/vmwgfx: validate pitch coming from userspace",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  drm/vmwgfx: validate pitch coming from userspace  Validate the pitch, alongside the box dimensions before trying to copy data from the underlying surface. Fixes possible out of bounds reads with cursor snooping.",
  "published": "2026-10-23T13:17:22Z",
  "severity": "Important",
  "cvss": 7.8,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.00164,
  "epssPercentile": 0.05643,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-99002",
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.12.115-2",
      "fix": "DEBIAN-CVE-2026-99002",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-99002",
      "released": "2026-10-24T13:25:57Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.2.11-1",
      "fix": "DEBIAN-CVE-2026-99002",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-99002",
      "released": "2026-10-24T13:25:57Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}