---
id: CVE-2026-74443
title: 'drm/vmwgfx: bound DMA command body size against suffix pointer'
summary: "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: bound DMA command body size against suffix pointer\n\nvmw_cmd_dma() locates the DMA suffix at\n\n\t(unsigned long) &cmd->body + header->size - sizeof(*suffix)\n\nw…"
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 4e4ddd47774313accc86b233d6ca2c6a9037a671 <
    eb20f418933bea53375843b27b4022c1810be63b
  - >-
    Linux >= 4e4ddd47774313accc86b233d6ca2c6a9037a671 <
    fcd1e56e7816b31a1050ccc67df722b20f6bb15d
  - >-
    Linux >= 4e4ddd47774313accc86b233d6ca2c6a9037a671 <
    a4a37080a5ac777b59306cfcdf854cc05d7604d4
  - >-
    Linux >= 4e4ddd47774313accc86b233d6ca2c6a9037a671 <
    036e16ada95389bdc30f41068af04c1d0872fad0
  - >-
    Linux >= 4e4ddd47774313accc86b233d6ca2c6a9037a671 <
    d5d7ada4e1296b00d89fe82b2ca850cc7809d6f7
  - >-
    Linux >= 4e4ddd47774313accc86b233d6ca2c6a9037a671 <
    7e40e6120fb232a10b543ffd994e5c6d8f3a2cc6
  - >-
    Linux >= 4e4ddd47774313accc86b233d6ca2c6a9037a671 <
    9759da60e38d7b9db44dc92713e4e0391883d221
  - >-
    Linux >= 4e4ddd47774313accc86b233d6ca2c6a9037a671 <
    f4f1db96bfd68b81053693ba53405b6f510ac16c
  - Linux 2.6.33
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T18:56:31.688956Z'
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T19:05:45.672Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-74443'
references:
  - url: 'https://git.kernel.org/stable/c/eb20f418933bea53375843b27b4022c1810be63b'
  - url: 'https://git.kernel.org/stable/c/fcd1e56e7816b31a1050ccc67df722b20f6bb15d'
  - url: 'https://git.kernel.org/stable/c/a4a37080a5ac777b59306cfcdf854cc05d7604d4'
  - url: 'https://git.kernel.org/stable/c/036e16ada95389bdc30f41068af04c1d0872fad0'
  - url: 'https://git.kernel.org/stable/c/d5d7ada4e1296b00d89fe82b2ca850cc7809d6f7'
  - url: 'https://git.kernel.org/stable/c/7e40e6120fb232a10b543ffd994e5c6d8f3a2cc6'
  - url: 'https://git.kernel.org/stable/c/9759da60e38d7b9db44dc92713e4e0391883d221'
  - url: 'https://git.kernel.org/stable/c/f4f1db96bfd68b81053693ba53405b6f510ac16c'
tags:
  - cve.org
epss: 0.00129
epssPercentile: 0.02273
ingestedAt: '2026-10-16T19:46:24.362Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/vmwgfx: bound DMA command body size against suffix pointer

vmw_cmd_dma() locates the DMA suffix at

	(unsigned long) &cmd->body + header->size - sizeof(*suffix)

without checking that header->size is large enough to contain both
cmd->body and the suffix.  An undersized header makes the suffix
pointer underflow back into the previous command in the bounce
buffer.  The verifier later writes suffix->maximumOffset, clobbering
verified fields of an already-relocated earlier command -- a TOCTOU
on the device-visible command stream that lets one command rewrite
another's GMR id, surface id, or other authenticated fields.

Reject the command if the body is too small for the suffix to fit.

## Affected

- `Linux >= 4e4ddd47774313accc86b233d6ca2c6a9037a671 < eb20f418933bea53375843b27b4022c1810be63b`
- `Linux >= 4e4ddd47774313accc86b233d6ca2c6a9037a671 < fcd1e56e7816b31a1050ccc67df722b20f6bb15d`
- `Linux >= 4e4ddd47774313accc86b233d6ca2c6a9037a671 < a4a37080a5ac777b59306cfcdf854cc05d7604d4`
- `Linux >= 4e4ddd47774313accc86b233d6ca2c6a9037a671 < 036e16ada95389bdc30f41068af04c1d0872fad0`
- `Linux >= 4e4ddd47774313accc86b233d6ca2c6a9037a671 < d5d7ada4e1296b00d89fe82b2ca850cc7809d6f7`
- `Linux >= 4e4ddd47774313accc86b233d6ca2c6a9037a671 < 7e40e6120fb232a10b543ffd994e5c6d8f3a2cc6`
- `Linux >= 4e4ddd47774313accc86b233d6ca2c6a9037a671 < 9759da60e38d7b9db44dc92713e4e0391883d221`
- `Linux >= 4e4ddd47774313accc86b233d6ca2c6a9037a671 < f4f1db96bfd68b81053693ba53405b6f510ac16c`
- `Linux 2.6.33`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.