In the Linux kernel, the following vulnerability has been resolved:
drm/vmwgfx: validate DRAW_PRIMITIVES header size before division
vmw_cmd_draw() computes
maxnum = (header->size - sizeof(cmd->body)) / sizeof(*decl);
where header->size is u32 and is taken straight from the user-supplied
command stream. When header->size is less than sizeof(cmd->body) the
unsigned subtraction wraps to nearly 4 GiB, producing a huge maxnum.
Any user-controlled cmd->body.numVertexDecls then passes the bound and
the loop dereferences decl[i] far past the end of the kernel command
bounce buffer, producing an out-of-bounds read of kernel memory.
Reject undersized headers up front.
References
Configurations
No configuration.
History
No history.
Information
Published : 2026-08-15 13:17
Updated : 2026-08-19 17:21
NVD link : CVE-2026-74444
Mitre link : CVE-2026-74444
CVE.ORG link : CVE-2026-74444
JSON object : View
Products Affected
No product.
CWE
No CWE.