---
id: CVE-2026-74443
title: "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: bound DMA command body size against suffix pointer\n\nvmw_cmd_dma() locates the DMA suffix at\n\n\t(unsigned long) &cmd->body + header->size - sizeof(*suffix)\n\nw…"
summary: "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: bound DMA command body size against suffix pointer\n\nvmw_cmd_dma() locates the DMA suffix at\n\n\t(unsigned long) &cmd->body + header->size - sizeof(*suffix)\n\nw…"
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 4e4ddd47774313accc86b233d6ca2c6a9037a671 <
    eb20f418933bea53375843b27b4022c1810be63b
  - >-
    Linux >= 4e4ddd47774313accc86b233d6ca2c6a9037a671 <
    fcd1e56e7816b31a1050ccc67df722b20f6bb15d
  - >-
    Linux >= 4e4ddd47774313accc86b233d6ca2c6a9037a671 <
    a4a37080a5ac777b59306cfcdf854cc05d7604d4
  - >-
    Linux >= 4e4ddd47774313accc86b233d6ca2c6a9037a671 <
    036e16ada95389bdc30f41068af04c1d0872fad0
  - >-
    Linux >= 4e4ddd47774313accc86b233d6ca2c6a9037a671 <
    d5d7ada4e1296b00d89fe82b2ca850cc7809d6f7
  - >-
    Linux >= 4e4ddd47774313accc86b233d6ca2c6a9037a671 <
    7e40e6120fb232a10b543ffd994e5c6d8f3a2cc6
  - >-
    Linux >= 4e4ddd47774313accc86b233d6ca2c6a9037a671 <
    9759da60e38d7b9db44dc92713e4e0391883d221
  - >-
    Linux >= 4e4ddd47774313accc86b233d6ca2c6a9037a671 <
    f4f1db96bfd68b81053693ba53405b6f510ac16c
  - Linux 2.6.33
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T20:17:27.933'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-74443'
references:
  - url: 'https://git.kernel.org/stable/c/036e16ada95389bdc30f41068af04c1d0872fad0'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/7e40e6120fb232a10b543ffd994e5c6d8f3a2cc6'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/9759da60e38d7b9db44dc92713e4e0391883d221'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a4a37080a5ac777b59306cfcdf854cc05d7604d4'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d5d7ada4e1296b00d89fe82b2ca850cc7809d6f7'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/eb20f418933bea53375843b27b4022c1810be63b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f4f1db96bfd68b81053693ba53405b6f510ac16c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/fcd1e56e7816b31a1050ccc67df722b20f6bb15d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00129
epssPercentile: 0.02548
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T18:56:31.688956Z'
ingestedAt: '2026-10-16T19:46:24.362Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/vmwgfx: bound DMA command body size against suffix pointer

vmw_cmd_dma() locates the DMA suffix at

	(unsigned long) &cmd->body + header->size - sizeof(*suffix)

without checking that header->size is large enough to contain both
cmd->body and the suffix.  An undersized header makes the suffix
pointer underflow back into the previous command in the bounce
buffer.  The verifier later writes suffix->maximumOffset, clobbering
verified fields of an already-relocated earlier command -- a TOCTOU
on the device-visible command stream that lets one command rewrite
another's GMR id, surface id, or other authenticated fields.

Reject the command if the body is too small for the suffix to fit.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.