CVE-2026-74443

drm/vmwgfx: bound DMA command body size against suffix pointer

State: Published
Severity: 8.8 High
Published: Aug 15, 2026
Updated: Oct 16, 2026
Reserved: Aug 15, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/vmwgfx: bound DMA command body size against suffix pointer

vmw_cmd_dma() locates the DMA suffix at

(unsigned long) &cmd->body + header->size - sizeof(*suffix)

without checking that header->size is large enough to contain both cmd->body and the suffix. An undersized header makes the suffix pointer underflow back into the previous command in the bounce buffer. The verifier later writes suffix->maximumOffset, clobbering verified fields of an already-relocated earlier command -- a TOCTOU on the device-visible command stream that lets one command rewrite another's GMR id, surface id, or other authenticated fields.

Reject the command if the body is too small for the suffix to fit.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	4e4ddd47774313accc86b233d6ca2c6a9037a671 to before eb20f418933bea53375843b27b4022c1810be63bAffected 4e4ddd47774313accc86b233d6ca2c6a9037a671 to before fcd1e56e7816b31a1050ccc67df722b20f6bb15dAffected 4e4ddd47774313accc86b233d6ca2c6a9037a671 to before a4a37080a5ac777b59306cfcdf854cc05d7604d4Affected 4e4ddd47774313accc86b233d6ca2c6a9037a671 to before 036e16ada95389bdc30f41068af04c1d0872fad0Affected 4e4ddd47774313accc86b233d6ca2c6a9037a671 to before d5d7ada4e1296b00d89fe82b2ca850cc7809d6f7Affected 4e4ddd47774313accc86b233d6ca2c6a9037a671 to before 7e40e6120fb232a10b543ffd994e5c6d8f3a2cc6Affected 4e4ddd47774313accc86b233d6ca2c6a9037a671 to before 9759da60e38d7b9db44dc92713e4e0391883d221Affected 4e4ddd47774313accc86b233d6ca2c6a9037a671 to before f4f1db96bfd68b81053693ba53405b6f510ac16cAffected
LinuxLinux	2.6.33Affected before 2.6.33Not affected 5.10.265 through 5.10.Not affected 5.15.216 through 5.15.Not affected 6.1.183 through 6.1.Not affected 6.6.151 through 6.6.Not affected 6.12.103 through 6.12.Not affected 6.18.44 through 6.18.Not affected 7.1.8 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

4e4ddd47774313accc86b233d6ca2c6a9037a671 to before eb20f418933bea53375843b27b4022c1810be63bAffected
4e4ddd47774313accc86b233d6ca2c6a9037a671 to before fcd1e56e7816b31a1050ccc67df722b20f6bb15dAffected
4e4ddd47774313accc86b233d6ca2c6a9037a671 to before a4a37080a5ac777b59306cfcdf854cc05d7604d4Affected
4e4ddd47774313accc86b233d6ca2c6a9037a671 to before 036e16ada95389bdc30f41068af04c1d0872fad0Affected
4e4ddd47774313accc86b233d6ca2c6a9037a671 to before d5d7ada4e1296b00d89fe82b2ca850cc7809d6f7Affected
4e4ddd47774313accc86b233d6ca2c6a9037a671 to before 7e40e6120fb232a10b543ffd994e5c6d8f3a2cc6Affected
4e4ddd47774313accc86b233d6ca2c6a9037a671 to before 9759da60e38d7b9db44dc92713e4e0391883d221Affected
4e4ddd47774313accc86b233d6ca2c6a9037a671 to before f4f1db96bfd68b81053693ba53405b6f510ac16cAffected

LinuxLinux

2.6.33Affected
before 2.6.33Not affected
5.10.265 through 5.10.*Not affected
5.15.216 through 5.15.*Not affected
6.1.183 through 6.1.*Not affected
6.6.151 through 6.6.*Not affected
6.12.103 through 6.12.*Not affected
6.18.44 through 6.18.*Not affected
7.1.8 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.