CVE-2026-74443

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: bound DMA command body size against suffix pointer vmw_cmd_dma() locates the DMA suffix at (unsigned long) &cmd->body + header->size - sizeof(*suffix) without checking that header->size is large enough to contain both cmd->body and the suffix. An undersized header makes the suffix pointer underflow back into the previous command in the bounce buffer. The verifier later writes suffix->maximumOffset, clobbering verified fields of an already-relocated earlier command -- a TOCTOU on the device-visible command stream that lets one command rewrite another's GMR id, surface id, or other authenticated fields. Reject the command if the body is too small for the suffix to fit.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.0 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://git.kernel.org/stable/c/036e16ada95389bdc30f41068af04c1d0872fad0
https://git.kernel.org/stable/c/7e40e6120fb232a10b543ffd994e5c6d8f3a2cc6
https://git.kernel.org/stable/c/9759da60e38d7b9db44dc92713e4e0391883d221
https://git.kernel.org/stable/c/a4a37080a5ac777b59306cfcdf854cc05d7604d4
https://git.kernel.org/stable/c/d5d7ada4e1296b00d89fe82b2ca850cc7809d6f7
https://git.kernel.org/stable/c/eb20f418933bea53375843b27b4022c1810be63b
https://git.kernel.org/stable/c/f4f1db96bfd68b81053693ba53405b6f510ac16c
https://git.kernel.org/stable/c/fcd1e56e7816b31a1050ccc67df722b20f6bb15d

Configurations

No configuration.

History

No history.

Information

Published : 2026-08-15 13:17

Updated : 2026-08-19 17:21

NVD link : CVE-2026-74443

Mitre link : CVE-2026-74443

CVE.ORG link : CVE-2026-74443

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2026-74443", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.0}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4e4ddd47774313accc86b233d6ca2c6a9037a671", "lessThan": "eb20f418933bea53375843b27b4022c1810be63b", "versionType": "git"}, {"status": "affected", "version": "4e4ddd47774313accc86b233d6ca2c6a9037a671", "lessThan": "fcd1e56e7816b31a1050ccc67df722b20f6bb15d", "versionType": "git"}, {"status": "affected", "version": "4e4ddd47774313accc86b233d6ca2c6a9037a671", "lessThan": "a4a37080a5ac777b59306cfcdf854cc05d7604d4", "versionType": "git"}, {"status": "affected", "version": "4e4ddd47774313accc86b233d6ca2c6a9037a671", "lessThan": "036e16ada95389bdc30f41068af04c1d0872fad0", "versionType": "git"}, {"status": "affected", "version": "4e4ddd47774313accc86b233d6ca2c6a9037a671", "lessThan": "d5d7ada4e1296b00d89fe82b2ca850cc7809d6f7", "versionType": "git"}, {"status": "affected", "version": "4e4ddd47774313accc86b233d6ca2c6a9037a671", "lessThan": "7e40e6120fb232a10b543ffd994e5c6d8f3a2cc6", "versionType": "git"}, {"status": "affected", "version": "4e4ddd47774313accc86b233d6ca2c6a9037a671", "lessThan": "9759da60e38d7b9db44dc92713e4e0391883d221", "versionType": "git"}, {"status": "affected", "version": "4e4ddd47774313accc86b233d6ca2c6a9037a671", "lessThan": "f4f1db96bfd68b81053693ba53405b6f510ac16c", "versionType": "git"}], "programFiles": ["drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2.6.33"}, {"status": "unaffected", "version": "0", "lessThan": "2.6.33", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.265", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.216", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.183", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.151", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.103", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.44", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.8", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c"], "defaultStatus": "affected"}]}], "published": "2026-08-15T13:17:48.863", "references": [{"url": "https://git.kernel.org/stable/c/036e16ada95389bdc30f41068af04c1d0872fad0", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/7e40e6120fb232a10b543ffd994e5c6d8f3a2cc6", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/9759da60e38d7b9db44dc92713e4e0391883d221", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/a4a37080a5ac777b59306cfcdf854cc05d7604d4", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/d5d7ada4e1296b00d89fe82b2ca850cc7809d6f7", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/eb20f418933bea53375843b27b4022c1810be63b", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/f4f1db96bfd68b81053693ba53405b6f510ac16c", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/fcd1e56e7816b31a1050ccc67df722b20f6bb15d", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Received", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: bound DMA command body size against suffix pointer\n\nvmw_cmd_dma() locates the DMA suffix at\n\n\t(unsigned long) &cmd->body + header->size - sizeof(*suffix)\n\nwithout checking that header->size is large enough to contain both\ncmd->body and the suffix. An undersized header makes the suffix\npointer underflow back into the previous command in the bounce\nbuffer. The verifier later writes suffix->maximumOffset, clobbering\nverified fields of an already-relocated earlier command -- a TOCTOU\non the device-visible command stream that lets one command rewrite\nanother's GMR id, surface id, or other authenticated fields.\n\nReject the command if the body is too small for the suffix to fit."}], "lastModified": "2026-08-19T17:21:01.520", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}