CVE-2026-74443 (GCVE-0-2026-74443)

Vulnerability from cvelistv5 – Published: 2026-08-15 12:26 – Updated: 2026-08-19 16:36
VLAI
Title
drm/vmwgfx: bound DMA command body size against suffix pointer
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: bound DMA command body size against suffix pointer vmw_cmd_dma() locates the DMA suffix at (unsigned long) &cmd->body + header->size - sizeof(*suffix) without checking that header->size is large enough to contain both cmd->body and the suffix. An undersized header makes the suffix pointer underflow back into the previous command in the bounce buffer. The verifier later writes suffix->maximumOffset, clobbering verified fields of an already-relocated earlier command -- a TOCTOU on the device-visible command stream that lets one command rewrite another's GMR id, surface id, or other authenticated fields. Reject the command if the body is too small for the suffix to fit.
Severity
8.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 4e4ddd47774313accc86b233d6ca2c6a9037a671 , < eb20f418933bea53375843b27b4022c1810be63b (git)
Affected: 4e4ddd47774313accc86b233d6ca2c6a9037a671 , < fcd1e56e7816b31a1050ccc67df722b20f6bb15d (git)
Affected: 4e4ddd47774313accc86b233d6ca2c6a9037a671 , < a4a37080a5ac777b59306cfcdf854cc05d7604d4 (git)
Affected: 4e4ddd47774313accc86b233d6ca2c6a9037a671 , < 036e16ada95389bdc30f41068af04c1d0872fad0 (git)
Affected: 4e4ddd47774313accc86b233d6ca2c6a9037a671 , < d5d7ada4e1296b00d89fe82b2ca850cc7809d6f7 (git)
Affected: 4e4ddd47774313accc86b233d6ca2c6a9037a671 , < 7e40e6120fb232a10b543ffd994e5c6d8f3a2cc6 (git)
Affected: 4e4ddd47774313accc86b233d6ca2c6a9037a671 , < 9759da60e38d7b9db44dc92713e4e0391883d221 (git)
Affected: 4e4ddd47774313accc86b233d6ca2c6a9037a671 , < f4f1db96bfd68b81053693ba53405b6f510ac16c (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.33
Unaffected: 0 , < 2.6.33 (semver)
Unaffected: 5.10.265 , ≤ 5.10.* (semver)
Unaffected: 5.15.216 , ≤ 5.15.* (semver)
Unaffected: 6.1.183 , ≤ 6.1.* (semver)
Unaffected: 6.6.151 , ≤ 6.6.* (semver)
Unaffected: 6.12.103 , ≤ 6.12.* (semver)
Unaffected: 6.18.44 , ≤ 6.18.* (semver)
Unaffected: 7.1.8 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "eb20f418933bea53375843b27b4022c1810be63b",
              "status": "affected",
              "version": "4e4ddd47774313accc86b233d6ca2c6a9037a671",
              "versionType": "git"
            },
            {
              "lessThan": "fcd1e56e7816b31a1050ccc67df722b20f6bb15d",
              "status": "affected",
              "version": "4e4ddd47774313accc86b233d6ca2c6a9037a671",
              "versionType": "git"
            },
            {
              "lessThan": "a4a37080a5ac777b59306cfcdf854cc05d7604d4",
              "status": "affected",
              "version": "4e4ddd47774313accc86b233d6ca2c6a9037a671",
              "versionType": "git"
            },
            {
              "lessThan": "036e16ada95389bdc30f41068af04c1d0872fad0",
              "status": "affected",
              "version": "4e4ddd47774313accc86b233d6ca2c6a9037a671",
              "versionType": "git"
            },
            {
              "lessThan": "d5d7ada4e1296b00d89fe82b2ca850cc7809d6f7",
              "status": "affected",
              "version": "4e4ddd47774313accc86b233d6ca2c6a9037a671",
              "versionType": "git"
            },
            {
              "lessThan": "7e40e6120fb232a10b543ffd994e5c6d8f3a2cc6",
              "status": "affected",
              "version": "4e4ddd47774313accc86b233d6ca2c6a9037a671",
              "versionType": "git"
            },
            {
              "lessThan": "9759da60e38d7b9db44dc92713e4e0391883d221",
              "status": "affected",
              "version": "4e4ddd47774313accc86b233d6ca2c6a9037a671",
              "versionType": "git"
            },
            {
              "lessThan": "f4f1db96bfd68b81053693ba53405b6f510ac16c",
              "status": "affected",
              "version": "4e4ddd47774313accc86b233d6ca2c6a9037a671",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.33"
            },
            {
              "lessThan": "2.6.33",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: bound DMA command body size against suffix pointer\n\nvmw_cmd_dma() locates the DMA suffix at\n\n\t(unsigned long) \u0026cmd-\u003ebody + header-\u003esize - sizeof(*suffix)\n\nwithout checking that header-\u003esize is large enough to contain both\ncmd-\u003ebody and the suffix.  An undersized header makes the suffix\npointer underflow back into the previous command in the bounce\nbuffer.  The verifier later writes suffix-\u003emaximumOffset, clobbering\nverified fields of an already-relocated earlier command -- a TOCTOU\non the device-visible command stream that lets one command rewrite\nanother\u0027s GMR id, surface id, or other authenticated fields.\n\nReject the command if the body is too small for the suffix to fit."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires issuing DRM_IOCTL_VMW_EXECBUF with a crafted SVGA command batch via /dev/dri/card* or /dev/dri/renderD*, the standard local DRM render-node path for the vmwgfx driver in VMware virtual machines.\nAC:L - The attacker fully controls execbuf command layout and can set an undersized SVGA_3D_CMD_SURFACE_DMA header-\u003esize so the suffix pointer underflows into the prior command; no races, rare configs, or victim-dependent heap layout are required.\nPR:L - VMW_EXECBUF is registered with DRM_RENDER_ALLOW, so any local user with access to the DRM render node (typically membership in the render/video group on VMware guests) can reach vmw_cmd_dma without real root in the init namespace.\nUI:N - No victim interaction is required beyond the attacker opening the DRM device and submitting a malicious execbuf ioctl; exploitation does not depend on another user mounting filesystems or performing other actions.\nS:C - The bug is a TOCTOU on the device-visible SVGA command stream: verifier writes clobber already-checked fields (GMR id, surface id, DMA bounds) in the bounce buffer before submission to the VMware virtual GPU, bypassing guest/host isolation enforced by command authentication.\nC:H - Rewriting authenticated GMR/surface identifiers or inflating maximumOffset can authorize SVGA surface DMA reads (including SVGA3D_READ_HOST_VRAM) beyond validated guest buffer bounds, yielding arbitrary guest memory disclosure and plausible host VRAM reads via the virtual device backend.\nI:H - Clobbering verified command fields lets a later command rewrite another\u0027s GMR id, surface id, or DMA limit so the hypervisor executes unauthorized SVGA3D_WRITE_HOST_VRAM or guest GMR DMA, enabling arbitrary memory write and code-execution primitives typical of kernel heap corruption.\nA:H - Corrupting the bounce-buffer command stream before FIFO submission can panic the guest kernel (invalid SVGA commands/resources) and enables repeatable denial of service; memory corruption in the verifier path is independently rated High per kernel CVSS guidance."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:36:35.874Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/eb20f418933bea53375843b27b4022c1810be63b"
        },
        {
          "url": "https://git.kernel.org/stable/c/fcd1e56e7816b31a1050ccc67df722b20f6bb15d"
        },
        {
          "url": "https://git.kernel.org/stable/c/a4a37080a5ac777b59306cfcdf854cc05d7604d4"
        },
        {
          "url": "https://git.kernel.org/stable/c/036e16ada95389bdc30f41068af04c1d0872fad0"
        },
        {
          "url": "https://git.kernel.org/stable/c/d5d7ada4e1296b00d89fe82b2ca850cc7809d6f7"
        },
        {
          "url": "https://git.kernel.org/stable/c/7e40e6120fb232a10b543ffd994e5c6d8f3a2cc6"
        },
        {
          "url": "https://git.kernel.org/stable/c/9759da60e38d7b9db44dc92713e4e0391883d221"
        },
        {
          "url": "https://git.kernel.org/stable/c/f4f1db96bfd68b81053693ba53405b6f510ac16c"
        }
      ],
      "title": "drm/vmwgfx: bound DMA command body size against suffix pointer",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74443",
    "datePublished": "2026-08-15T12:26:50.826Z",
    "dateReserved": "2026-08-15T05:44:03.898Z",
    "dateUpdated": "2026-08-19T16:36:35.874Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74443",
      "date": "2026-08-28",
      "epss": "0.00129",
      "percentile": "0.02852"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-23T14:54:55.000Z",
      "cve": "CVE-2026-74443",
      "id": "msrc_CVE-2026-74443",
      "initial_release_date": "2026-08-23T14:54:55.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "drm/vmwgfx: bound DMA command body size against suffix pointer",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74443.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-74443\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-15T13:17:48.863\",\"lastModified\":\"2026-08-19T17:21:01.520\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/vmwgfx: bound DMA command body size against suffix pointer\\n\\nvmw_cmd_dma() locates the DMA suffix at\\n\\n\\t(unsigned long) \u0026cmd-\u003ebody + header-\u003esize - sizeof(*suffix)\\n\\nwithout checking that header-\u003esize is large enough to contain both\\ncmd-\u003ebody and the suffix.  An undersized header makes the suffix\\npointer underflow back into the previous command in the bounce\\nbuffer.  The verifier later writes suffix-\u003emaximumOffset, clobbering\\nverified fields of an already-relocated earlier command -- a TOCTOU\\non the device-visible command stream that lets one command rewrite\\nanother\u0027s GMR id, surface id, or other authenticated fields.\\n\\nReject the command if the body is too small for the suffix to fit.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4e4ddd47774313accc86b233d6ca2c6a9037a671\",\"lessThan\":\"eb20f418933bea53375843b27b4022c1810be63b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4e4ddd47774313accc86b233d6ca2c6a9037a671\",\"lessThan\":\"fcd1e56e7816b31a1050ccc67df722b20f6bb15d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4e4ddd47774313accc86b233d6ca2c6a9037a671\",\"lessThan\":\"a4a37080a5ac777b59306cfcdf854cc05d7604d4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4e4ddd47774313accc86b233d6ca2c6a9037a671\",\"lessThan\":\"036e16ada95389bdc30f41068af04c1d0872fad0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4e4ddd47774313accc86b233d6ca2c6a9037a671\",\"lessThan\":\"d5d7ada4e1296b00d89fe82b2ca850cc7809d6f7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4e4ddd47774313accc86b233d6ca2c6a9037a671\",\"lessThan\":\"7e40e6120fb232a10b543ffd994e5c6d8f3a2cc6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4e4ddd47774313accc86b233d6ca2c6a9037a671\",\"lessThan\":\"9759da60e38d7b9db44dc92713e4e0391883d221\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4e4ddd47774313accc86b233d6ca2c6a9037a671\",\"lessThan\":\"f4f1db96bfd68b81053693ba53405b6f510ac16c\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.33\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.33\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.265\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.216\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.183\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.151\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.103\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.44\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.8\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.0,\"impactScore\":6.0}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/036e16ada95389bdc30f41068af04c1d0872fad0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7e40e6120fb232a10b543ffd994e5c6d8f3a2cc6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9759da60e38d7b9db44dc92713e4e0391883d221\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a4a37080a5ac777b59306cfcdf854cc05d7604d4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d5d7ada4e1296b00d89fe82b2ca850cc7809d6f7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/eb20f418933bea53375843b27b4022c1810be63b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f4f1db96bfd68b81053693ba53405b6f510ac16c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/fcd1e56e7816b31a1050ccc67df722b20f6bb15d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-21T11:32:43+00:00",
      "cve": "CVE-2026-74443",
      "id": "CVE-2026-74443",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/vmwgfx: bound DMA command body size against suffix pointer",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74443.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.