---
id: CVE-2026-74444
title: "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: validate DRAW_PRIMITIVES header size before division\n\nvmw_cmd_draw() computes\n\n\tmaxnum = (header->size - sizeof(cmd->body)) / sizeof(*decl);\n\nwhere header->…"
summary: "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: validate DRAW_PRIMITIVES header size before division\n\nvmw_cmd_draw() computes\n\n\tmaxnum = (header->size - sizeof(cmd->body)) / sizeof(*decl);\n\nwhere header->…"
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 7a73ba7469cbea631050094fd14f73acebb97cf9 <
    b89ca4bba820f79dde52af15ee139fe6e8bbc314
  - >-
    Linux >= 7a73ba7469cbea631050094fd14f73acebb97cf9 <
    bef30317fcb4c838a37bceb2fc76256eb6b975c1
  - >-
    Linux >= 7a73ba7469cbea631050094fd14f73acebb97cf9 <
    112c6ff29a56f3a22db4d5af869697aa07035ad6
  - >-
    Linux >= 7a73ba7469cbea631050094fd14f73acebb97cf9 <
    2666cddf0dd218aa9bd1f99db688d1b532eac21a
  - >-
    Linux >= 7a73ba7469cbea631050094fd14f73acebb97cf9 <
    fc0c02f510e41650df3479f96e257acf87d8a20a
  - >-
    Linux >= 7a73ba7469cbea631050094fd14f73acebb97cf9 <
    dc0be7662b7b0ce28cb5eea864737793ed7b9e70
  - >-
    Linux >= 7a73ba7469cbea631050094fd14f73acebb97cf9 <
    c77cf8edae2bd3a1599115301cc7c98d0c78e731
  - >-
    Linux >= 7a73ba7469cbea631050094fd14f73acebb97cf9 <
    85891d174707d8bddcec7a888fb4e1d17def34f3
  - Linux 2.6.33
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T20:17:28.103'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-74444'
references:
  - url: 'https://git.kernel.org/stable/c/112c6ff29a56f3a22db4d5af869697aa07035ad6'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/2666cddf0dd218aa9bd1f99db688d1b532eac21a'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/85891d174707d8bddcec7a888fb4e1d17def34f3'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/b89ca4bba820f79dde52af15ee139fe6e8bbc314'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/bef30317fcb4c838a37bceb2fc76256eb6b975c1'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/c77cf8edae2bd3a1599115301cc7c98d0c78e731'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/dc0be7662b7b0ce28cb5eea864737793ed7b9e70'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/fc0c02f510e41650df3479f96e257acf87d8a20a'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00129
epssPercentile: 0.02548
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T18:56:36.182833Z'
ingestedAt: '2026-10-16T19:46:24.363Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/vmwgfx: validate DRAW_PRIMITIVES header size before division

vmw_cmd_draw() computes

	maxnum = (header->size - sizeof(cmd->body)) / sizeof(*decl);

where header->size is u32 and is taken straight from the user-supplied
command stream.  When header->size is less than sizeof(cmd->body) the
unsigned subtraction wraps to nearly 4 GiB, producing a huge maxnum.
Any user-controlled cmd->body.numVertexDecls then passes the bound and
the loop dereferences decl[i] far past the end of the kernel command
bounce buffer, producing an out-of-bounds read of kernel memory.

Reject undersized headers up front.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.