CVE-2026-74443

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-74443
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74443.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-74443
Downstream
Published
2026-08-15T12:26:50Z
Modified
2026-08-21T03:30:41Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
Summary
drm/vmwgfx: bound DMA command body size against suffix pointer
Details

In the Linux kernel, the following vulnerability has been resolved:

drm/vmwgfx: bound DMA command body size against suffix pointer

vmw_cmd_dma() locates the DMA suffix at

(unsigned long) &cmd->body + header->size - sizeof(*suffix)

without checking that header->size is large enough to contain both cmd->body and the suffix. An undersized header makes the suffix pointer underflow back into the previous command in the bounce buffer. The verifier later writes suffix->maximumOffset, clobbering verified fields of an already-relocated earlier command -- a TOCTOU on the device-visible command stream that lets one command rewrite another's GMR id, surface id, or other authenticated fields.

Reject the command if the body is too small for the suffix to fit.

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74443.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
4e4ddd47774313accc86b233d6ca2c6a9037a671
Fixed
eb20f418933bea53375843b27b4022c1810be63b
Fixed
fcd1e56e7816b31a1050ccc67df722b20f6bb15d
Fixed
a4a37080a5ac777b59306cfcdf854cc05d7604d4
Fixed
036e16ada95389bdc30f41068af04c1d0872fad0
Fixed
d5d7ada4e1296b00d89fe82b2ca850cc7809d6f7
Fixed
7e40e6120fb232a10b543ffd994e5c6d8f3a2cc6
Fixed
9759da60e38d7b9db44dc92713e4e0391883d221
Fixed
f4f1db96bfd68b81053693ba53405b6f510ac16c

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74443.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.6.33
Fixed
5.10.265
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.216
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.183
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.151
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.103
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.44
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.1.8

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74443.json"