{"id":"CVE-2026-74443","title":"drm/vmwgfx: bound DMA command body size against suffix pointer","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: bound DMA command body size against suffix pointer\n\nvmw_cmd_dma() locates the DMA suffix at\n\n\t(unsigned long) &cmd->body + header->size - sizeof(*suffix)\n\nw…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 4e4ddd47774313accc86b233d6ca2c6a9037a671 < eb20f418933bea53375843b27b4022c1810be63b","Linux >= 4e4ddd47774313accc86b233d6ca2c6a9037a671 < fcd1e56e7816b31a1050ccc67df722b20f6bb15d","Linux >= 4e4ddd47774313accc86b233d6ca2c6a9037a671 < a4a37080a5ac777b59306cfcdf854cc05d7604d4","Linux >= 4e4ddd47774313accc86b233d6ca2c6a9037a671 < 036e16ada95389bdc30f41068af04c1d0872fad0","Linux >= 4e4ddd47774313accc86b233d6ca2c6a9037a671 < d5d7ada4e1296b00d89fe82b2ca850cc7809d6f7","Linux >= 4e4ddd47774313accc86b233d6ca2c6a9037a671 < 7e40e6120fb232a10b543ffd994e5c6d8f3a2cc6","Linux >= 4e4ddd47774313accc86b233d6ca2c6a9037a671 < 9759da60e38d7b9db44dc92713e4e0391883d221","Linux >= 4e4ddd47774313accc86b233d6ca2c6a9037a671 < f4f1db96bfd68b81053693ba53405b6f510ac16c","Linux 2.6.33"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T18:56:31.688956Z"},"published":"2026-08-15","updated":"2026-10-16","sourceUpdated":"2026-10-16T19:05:45.672Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-74443","references":[{"url":"https://git.kernel.org/stable/c/eb20f418933bea53375843b27b4022c1810be63b"},{"url":"https://git.kernel.org/stable/c/fcd1e56e7816b31a1050ccc67df722b20f6bb15d"},{"url":"https://git.kernel.org/stable/c/a4a37080a5ac777b59306cfcdf854cc05d7604d4"},{"url":"https://git.kernel.org/stable/c/036e16ada95389bdc30f41068af04c1d0872fad0"},{"url":"https://git.kernel.org/stable/c/d5d7ada4e1296b00d89fe82b2ca850cc7809d6f7"},{"url":"https://git.kernel.org/stable/c/7e40e6120fb232a10b543ffd994e5c6d8f3a2cc6"},{"url":"https://git.kernel.org/stable/c/9759da60e38d7b9db44dc92713e4e0391883d221"},{"url":"https://git.kernel.org/stable/c/f4f1db96bfd68b81053693ba53405b6f510ac16c"}],"tags":["cve.org"],"epss":0.00129,"epssPercentile":0.02273,"ingestedAt":"2026-10-16T19:46:24.362Z","slug":"CVE-2026-74443","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: bound DMA command body size against suffix pointer\n\nvmw_cmd_dma() locates the DMA suffix at\n\n\t(unsigned long) &cmd->body + header->size - sizeof(*suffix)\n\nwithout checking that header->size is large enough to contain both\ncmd->body and the suffix.  An undersized header makes the suffix\npointer underflow back into the previous command in the bounce\nbuffer.  The verifier later writes suffix->maximumOffset, clobbering\nverified fields of an already-relocated earlier command -- a TOCTOU\non the device-visible command stream that lets one command rewrite\nanother's GMR id, surface id, or other authenticated fields.\n\nReject the command if the body is too small for the suffix to fit.\n\n## Affected\n\n- `Linux >= 4e4ddd47774313accc86b233d6ca2c6a9037a671 < eb20f418933bea53375843b27b4022c1810be63b`\n- `Linux >= 4e4ddd47774313accc86b233d6ca2c6a9037a671 < fcd1e56e7816b31a1050ccc67df722b20f6bb15d`\n- `Linux >= 4e4ddd47774313accc86b233d6ca2c6a9037a671 < a4a37080a5ac777b59306cfcdf854cc05d7604d4`\n- `Linux >= 4e4ddd47774313accc86b233d6ca2c6a9037a671 < 036e16ada95389bdc30f41068af04c1d0872fad0`\n- `Linux >= 4e4ddd47774313accc86b233d6ca2c6a9037a671 < d5d7ada4e1296b00d89fe82b2ca850cc7809d6f7`\n- `Linux >= 4e4ddd47774313accc86b233d6ca2c6a9037a671 < 7e40e6120fb232a10b543ffd994e5c6d8f3a2cc6`\n- `Linux >= 4e4ddd47774313accc86b233d6ca2c6a9037a671 < 9759da60e38d7b9db44dc92713e4e0391883d221`\n- `Linux >= 4e4ddd47774313accc86b233d6ca2c6a9037a671 < f4f1db96bfd68b81053693ba53405b6f510ac16c`\n- `Linux 2.6.33`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}