{"id":"CVE-2026-74443","title":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: bound DMA command body size against suffix pointer\n\nvmw_cmd_dma() locates the DMA suffix at\n\n\t(unsigned long) &cmd->body + header->size - sizeof(*suffix)\n\nw…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: bound DMA command body size against suffix pointer\n\nvmw_cmd_dma() locates the DMA suffix at\n\n\t(unsigned long) &cmd->body + header->size - sizeof(*suffix)\n\nw…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","vendor":"Linux","product":"Linux","affected":["Linux >= 4e4ddd47774313accc86b233d6ca2c6a9037a671 < eb20f418933bea53375843b27b4022c1810be63b","Linux >= 4e4ddd47774313accc86b233d6ca2c6a9037a671 < fcd1e56e7816b31a1050ccc67df722b20f6bb15d","Linux >= 4e4ddd47774313accc86b233d6ca2c6a9037a671 < a4a37080a5ac777b59306cfcdf854cc05d7604d4","Linux >= 4e4ddd47774313accc86b233d6ca2c6a9037a671 < 036e16ada95389bdc30f41068af04c1d0872fad0","Linux >= 4e4ddd47774313accc86b233d6ca2c6a9037a671 < d5d7ada4e1296b00d89fe82b2ca850cc7809d6f7","Linux >= 4e4ddd47774313accc86b233d6ca2c6a9037a671 < 7e40e6120fb232a10b543ffd994e5c6d8f3a2cc6","Linux >= 4e4ddd47774313accc86b233d6ca2c6a9037a671 < 9759da60e38d7b9db44dc92713e4e0391883d221","Linux >= 4e4ddd47774313accc86b233d6ca2c6a9037a671 < f4f1db96bfd68b81053693ba53405b6f510ac16c","Linux 2.6.33"],"published":"2026-08-15","updated":"2026-10-16","sourceUpdated":"2026-10-16T20:17:27.933","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-74443","references":[{"url":"https://git.kernel.org/stable/c/036e16ada95389bdc30f41068af04c1d0872fad0","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7e40e6120fb232a10b543ffd994e5c6d8f3a2cc6","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9759da60e38d7b9db44dc92713e4e0391883d221","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a4a37080a5ac777b59306cfcdf854cc05d7604d4","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d5d7ada4e1296b00d89fe82b2ca850cc7809d6f7","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/eb20f418933bea53375843b27b4022c1810be63b","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f4f1db96bfd68b81053693ba53405b6f510ac16c","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fcd1e56e7816b31a1050ccc67df722b20f6bb15d","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd","cve.org"],"epss":0.00129,"epssPercentile":0.02548,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T18:56:31.688956Z"},"ingestedAt":"2026-10-16T19:46:24.362Z","slug":"CVE-2026-74443","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: bound DMA command body size against suffix pointer\n\nvmw_cmd_dma() locates the DMA suffix at\n\n\t(unsigned long) &cmd->body + header->size - sizeof(*suffix)\n\nwithout checking that header->size is large enough to contain both\ncmd->body and the suffix.  An undersized header makes the suffix\npointer underflow back into the previous command in the bounce\nbuffer.  The verifier later writes suffix->maximumOffset, clobbering\nverified fields of an already-relocated earlier command -- a TOCTOU\non the device-visible command stream that lets one command rewrite\nanother's GMR id, surface id, or other authenticated fields.\n\nReject the command if the body is too small for the suffix to fit.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}