{"api_version":"1","generated_at":"2026-08-22T15:29:04+00:00","cve":"CVE-2026-74443","urls":{"html":"https://cve.report/CVE-2026-74443","api":"https://cve.report/api/cve/CVE-2026-74443.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-74443","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-74443"},"summary":{"title":"drm/vmwgfx: bound DMA command body size against suffix pointer","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: bound DMA command body size against suffix pointer\n\nvmw_cmd_dma() locates the DMA suffix at\n\n\t(unsigned long) &cmd->body + header->size - sizeof(*suffix)\n\nwithout checking that header->size is large enough to contain both\ncmd->body and the suffix.  An undersized header makes the suffix\npointer underflow back into the previous command in the bounce\nbuffer.  The verifier later writes suffix->maximumOffset, clobbering\nverified fields of an already-relocated earlier command -- a TOCTOU\non the device-visible command stream that lets one command rewrite\nanother's GMR id, surface id, or other authenticated fields.\n\nReject the command if the body is too small for the suffix to fit.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-08-15 13:17:48","updated_at":"2026-08-19 17:21:01"},"problem_types":[],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"8.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"8.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","data":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/f4f1db96bfd68b81053693ba53405b6f510ac16c","name":"https://git.kernel.org/stable/c/f4f1db96bfd68b81053693ba53405b6f510ac16c","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/eb20f418933bea53375843b27b4022c1810be63b","name":"https://git.kernel.org/stable/c/eb20f418933bea53375843b27b4022c1810be63b","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/7e40e6120fb232a10b543ffd994e5c6d8f3a2cc6","name":"https://git.kernel.org/stable/c/7e40e6120fb232a10b543ffd994e5c6d8f3a2cc6","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/d5d7ada4e1296b00d89fe82b2ca850cc7809d6f7","name":"https://git.kernel.org/stable/c/d5d7ada4e1296b00d89fe82b2ca850cc7809d6f7","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/036e16ada95389bdc30f41068af04c1d0872fad0","name":"https://git.kernel.org/stable/c/036e16ada95389bdc30f41068af04c1d0872fad0","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/9759da60e38d7b9db44dc92713e4e0391883d221","name":"https://git.kernel.org/stable/c/9759da60e38d7b9db44dc92713e4e0391883d221","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/fcd1e56e7816b31a1050ccc67df722b20f6bb15d","name":"https://git.kernel.org/stable/c/fcd1e56e7816b31a1050ccc67df722b20f6bb15d","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/a4a37080a5ac777b59306cfcdf854cc05d7604d4","name":"https://git.kernel.org/stable/c/a4a37080a5ac777b59306cfcdf854cc05d7604d4","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-74443","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74443","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4e4ddd47774313accc86b233d6ca2c6a9037a671 eb20f418933bea53375843b27b4022c1810be63b git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4e4ddd47774313accc86b233d6ca2c6a9037a671 fcd1e56e7816b31a1050ccc67df722b20f6bb15d git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4e4ddd47774313accc86b233d6ca2c6a9037a671 a4a37080a5ac777b59306cfcdf854cc05d7604d4 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4e4ddd47774313accc86b233d6ca2c6a9037a671 036e16ada95389bdc30f41068af04c1d0872fad0 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4e4ddd47774313accc86b233d6ca2c6a9037a671 d5d7ada4e1296b00d89fe82b2ca850cc7809d6f7 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4e4ddd47774313accc86b233d6ca2c6a9037a671 7e40e6120fb232a10b543ffd994e5c6d8f3a2cc6 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4e4ddd47774313accc86b233d6ca2c6a9037a671 9759da60e38d7b9db44dc92713e4e0391883d221 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4e4ddd47774313accc86b233d6ca2c6a9037a671 f4f1db96bfd68b81053693ba53405b6f510ac16c git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 2.6.33","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 2.6.33 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.10.265 5.10.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.15.216 5.15.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.1.183 6.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.151 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.103 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.44 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1.8 7.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"74443","cve":"CVE-2026-74443","epss":"0.001290000","percentile":"0.029470000","score_date":"2026-08-19","updated_at":"2026-08-20 00:13:09"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"eb20f418933bea53375843b27b4022c1810be63b","status":"affected","version":"4e4ddd47774313accc86b233d6ca2c6a9037a671","versionType":"git"},{"lessThan":"fcd1e56e7816b31a1050ccc67df722b20f6bb15d","status":"affected","version":"4e4ddd47774313accc86b233d6ca2c6a9037a671","versionType":"git"},{"lessThan":"a4a37080a5ac777b59306cfcdf854cc05d7604d4","status":"affected","version":"4e4ddd47774313accc86b233d6ca2c6a9037a671","versionType":"git"},{"lessThan":"036e16ada95389bdc30f41068af04c1d0872fad0","status":"affected","version":"4e4ddd47774313accc86b233d6ca2c6a9037a671","versionType":"git"},{"lessThan":"d5d7ada4e1296b00d89fe82b2ca850cc7809d6f7","status":"affected","version":"4e4ddd47774313accc86b233d6ca2c6a9037a671","versionType":"git"},{"lessThan":"7e40e6120fb232a10b543ffd994e5c6d8f3a2cc6","status":"affected","version":"4e4ddd47774313accc86b233d6ca2c6a9037a671","versionType":"git"},{"lessThan":"9759da60e38d7b9db44dc92713e4e0391883d221","status":"affected","version":"4e4ddd47774313accc86b233d6ca2c6a9037a671","versionType":"git"},{"lessThan":"f4f1db96bfd68b81053693ba53405b6f510ac16c","status":"affected","version":"4e4ddd47774313accc86b233d6ca2c6a9037a671","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.33"},{"lessThan":"2.6.33","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.265","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.216","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.183","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.151","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.103","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.44","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.8","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.10.265","versionStartIncluding":"2.6.33","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.15.216","versionStartIncluding":"2.6.33","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.183","versionStartIncluding":"2.6.33","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.151","versionStartIncluding":"2.6.33","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.103","versionStartIncluding":"2.6.33","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.44","versionStartIncluding":"2.6.33","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1.8","versionStartIncluding":"2.6.33","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2","versionStartIncluding":"2.6.33","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: bound DMA command body size against suffix pointer\n\nvmw_cmd_dma() locates the DMA suffix at\n\n\t(unsigned long) &cmd->body + header->size - sizeof(*suffix)\n\nwithout checking that header->size is large enough to contain both\ncmd->body and the suffix.  An undersized header makes the suffix\npointer underflow back into the previous command in the bounce\nbuffer.  The verifier later writes suffix->maximumOffset, clobbering\nverified fields of an already-relocated earlier command -- a TOCTOU\non the device-visible command stream that lets one command rewrite\nanother's GMR id, surface id, or other authenticated fields.\n\nReject the command if the body is too small for the suffix to fit."}],"metrics":[{"cvssV3_1":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires issuing DRM_IOCTL_VMW_EXECBUF with a crafted SVGA command batch via /dev/dri/card* or /dev/dri/renderD*, the standard local DRM render-node path for the vmwgfx driver in VMware virtual machines.\nAC:L - The attacker fully controls execbuf command layout and can set an undersized SVGA_3D_CMD_SURFACE_DMA header->size so the suffix pointer underflows into the prior command; no races, rare configs, or victim-dependent heap layout are required.\nPR:L - VMW_EXECBUF is registered with DRM_RENDER_ALLOW, so any local user with access to the DRM render node (typically membership in the render/video group on VMware guests) can reach vmw_cmd_dma without real root in the init namespace.\nUI:N - No victim interaction is required beyond the attacker opening the DRM device and submitting a malicious execbuf ioctl; exploitation does not depend on another user mounting filesystems or performing other actions.\nS:C - The bug is a TOCTOU on the device-visible SVGA command stream: verifier writes clobber already-checked fields (GMR id, surface id, DMA bounds) in the bounce buffer before submission to the VMware virtual GPU, bypassing guest/host isolation enforced by command authentication.\nC:H - Rewriting authenticated GMR/surface identifiers or inflating maximumOffset can authorize SVGA surface DMA reads (including SVGA3D_READ_HOST_VRAM) beyond validated guest buffer bounds, yielding arbitrary guest memory disclosure and plausible host VRAM reads via the virtual device backend.\nI:H - Clobbering verified command fields lets a later command rewrite another's GMR id, surface id, or DMA limit so the hypervisor executes unauthorized SVGA3D_WRITE_HOST_VRAM or guest GMR DMA, enabling arbitrary memory write and code-execution primitives typical of kernel heap corruption.\nA:H - Corrupting the bounce-buffer command stream before FIFO submission can panic the guest kernel (invalid SVGA commands/resources) and enables repeatable denial of service; memory corruption in the verifier path is independently rated High per kernel CVSS guidance."}]}],"providerMetadata":{"dateUpdated":"2026-08-19T16:36:35.874Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/eb20f418933bea53375843b27b4022c1810be63b"},{"url":"https://git.kernel.org/stable/c/fcd1e56e7816b31a1050ccc67df722b20f6bb15d"},{"url":"https://git.kernel.org/stable/c/a4a37080a5ac777b59306cfcdf854cc05d7604d4"},{"url":"https://git.kernel.org/stable/c/036e16ada95389bdc30f41068af04c1d0872fad0"},{"url":"https://git.kernel.org/stable/c/d5d7ada4e1296b00d89fe82b2ca850cc7809d6f7"},{"url":"https://git.kernel.org/stable/c/7e40e6120fb232a10b543ffd994e5c6d8f3a2cc6"},{"url":"https://git.kernel.org/stable/c/9759da60e38d7b9db44dc92713e4e0391883d221"},{"url":"https://git.kernel.org/stable/c/f4f1db96bfd68b81053693ba53405b6f510ac16c"}],"title":"drm/vmwgfx: bound DMA command body size against suffix pointer","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-74443","datePublished":"2026-08-15T12:26:50.826Z","dateReserved":"2026-08-15T05:44:03.898Z","dateUpdated":"2026-08-19T16:36:35.874Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-15 13:17:48","lastModifiedDate":"2026-08-19 17:21:01","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2,"impactScore":6}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"74443","Ordinal":"1","Title":"drm/vmwgfx: bound DMA command body size against suffix pointer","CVE":"CVE-2026-74443","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"74443","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: bound DMA command body size against suffix pointer\n\nvmw_cmd_dma() locates the DMA suffix at\n\n\t(unsigned long) &cmd->body + header->size - sizeof(*suffix)\n\nwithout checking that header->size is large enough to contain both\ncmd->body and the suffix.  An undersized header makes the suffix\npointer underflow back into the previous command in the bounce\nbuffer.  The verifier later writes suffix->maximumOffset, clobbering\nverified fields of an already-relocated earlier command -- a TOCTOU\non the device-visible command stream that lets one command rewrite\nanother's GMR id, surface id, or other authenticated fields.\n\nReject the command if the body is too small for the suffix to fit.","Type":"Description","Title":"drm/vmwgfx: bound DMA command body size against suffix pointer"}]}}}