---
id: CVE-2026-74444
title: 'drm/vmwgfx: validate DRAW_PRIMITIVES header size before division'
summary: "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: validate DRAW_PRIMITIVES header size before division\n\nvmw_cmd_draw() computes\n\n\tmaxnum = (header->size - sizeof(cmd->body)) / sizeof(*decl);\n\nwhere header->…"
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 7a73ba7469cbea631050094fd14f73acebb97cf9 <
    b89ca4bba820f79dde52af15ee139fe6e8bbc314
  - >-
    Linux >= 7a73ba7469cbea631050094fd14f73acebb97cf9 <
    bef30317fcb4c838a37bceb2fc76256eb6b975c1
  - >-
    Linux >= 7a73ba7469cbea631050094fd14f73acebb97cf9 <
    112c6ff29a56f3a22db4d5af869697aa07035ad6
  - >-
    Linux >= 7a73ba7469cbea631050094fd14f73acebb97cf9 <
    2666cddf0dd218aa9bd1f99db688d1b532eac21a
  - >-
    Linux >= 7a73ba7469cbea631050094fd14f73acebb97cf9 <
    fc0c02f510e41650df3479f96e257acf87d8a20a
  - >-
    Linux >= 7a73ba7469cbea631050094fd14f73acebb97cf9 <
    dc0be7662b7b0ce28cb5eea864737793ed7b9e70
  - >-
    Linux >= 7a73ba7469cbea631050094fd14f73acebb97cf9 <
    c77cf8edae2bd3a1599115301cc7c98d0c78e731
  - >-
    Linux >= 7a73ba7469cbea631050094fd14f73acebb97cf9 <
    85891d174707d8bddcec7a888fb4e1d17def34f3
  - Linux 2.6.33
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T18:56:36.182833Z'
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T19:05:45.890Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-74444'
references:
  - url: 'https://git.kernel.org/stable/c/b89ca4bba820f79dde52af15ee139fe6e8bbc314'
  - url: 'https://git.kernel.org/stable/c/bef30317fcb4c838a37bceb2fc76256eb6b975c1'
  - url: 'https://git.kernel.org/stable/c/112c6ff29a56f3a22db4d5af869697aa07035ad6'
  - url: 'https://git.kernel.org/stable/c/2666cddf0dd218aa9bd1f99db688d1b532eac21a'
  - url: 'https://git.kernel.org/stable/c/fc0c02f510e41650df3479f96e257acf87d8a20a'
  - url: 'https://git.kernel.org/stable/c/dc0be7662b7b0ce28cb5eea864737793ed7b9e70'
  - url: 'https://git.kernel.org/stable/c/c77cf8edae2bd3a1599115301cc7c98d0c78e731'
  - url: 'https://git.kernel.org/stable/c/85891d174707d8bddcec7a888fb4e1d17def34f3'
tags:
  - cve.org
epss: 0.00129
epssPercentile: 0.02273
ingestedAt: '2026-10-16T19:46:24.363Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/vmwgfx: validate DRAW_PRIMITIVES header size before division

vmw_cmd_draw() computes

	maxnum = (header->size - sizeof(cmd->body)) / sizeof(*decl);

where header->size is u32 and is taken straight from the user-supplied
command stream.  When header->size is less than sizeof(cmd->body) the
unsigned subtraction wraps to nearly 4 GiB, producing a huge maxnum.
Any user-controlled cmd->body.numVertexDecls then passes the bound and
the loop dereferences decl[i] far past the end of the kernel command
bounce buffer, producing an out-of-bounds read of kernel memory.

Reject undersized headers up front.

## Affected

- `Linux >= 7a73ba7469cbea631050094fd14f73acebb97cf9 < b89ca4bba820f79dde52af15ee139fe6e8bbc314`
- `Linux >= 7a73ba7469cbea631050094fd14f73acebb97cf9 < bef30317fcb4c838a37bceb2fc76256eb6b975c1`
- `Linux >= 7a73ba7469cbea631050094fd14f73acebb97cf9 < 112c6ff29a56f3a22db4d5af869697aa07035ad6`
- `Linux >= 7a73ba7469cbea631050094fd14f73acebb97cf9 < 2666cddf0dd218aa9bd1f99db688d1b532eac21a`
- `Linux >= 7a73ba7469cbea631050094fd14f73acebb97cf9 < fc0c02f510e41650df3479f96e257acf87d8a20a`
- `Linux >= 7a73ba7469cbea631050094fd14f73acebb97cf9 < dc0be7662b7b0ce28cb5eea864737793ed7b9e70`
- `Linux >= 7a73ba7469cbea631050094fd14f73acebb97cf9 < c77cf8edae2bd3a1599115301cc7c98d0c78e731`
- `Linux >= 7a73ba7469cbea631050094fd14f73acebb97cf9 < 85891d174707d8bddcec7a888fb4e1d17def34f3`
- `Linux 2.6.33`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.