{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-74443","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-08-15T05:44:03.898Z","datePublished":"2026-08-15T12:26:50.826Z","dateUpdated":"2026-08-19T16:36:35.874Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-19T16:36:35.874Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: bound DMA command body size against suffix pointer\n\nvmw_cmd_dma() locates the DMA suffix at\n\n\t(unsigned long) &cmd->body + header->size - sizeof(*suffix)\n\nwithout checking that header->size is large enough to contain both\ncmd->body and the suffix.  An undersized header makes the suffix\npointer underflow back into the previous command in the bounce\nbuffer.  The verifier later writes suffix->maximumOffset, clobbering\nverified fields of an already-relocated earlier command -- a TOCTOU\non the device-visible command stream that lets one command rewrite\nanother's GMR id, surface id, or other authenticated fields.\n\nReject the command if the body is too small for the suffix to fit."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires issuing DRM_IOCTL_VMW_EXECBUF with a crafted SVGA command batch via /dev/dri/card* or /dev/dri/renderD*, the standard local DRM render-node path for the vmwgfx driver in VMware virtual machines.\nAC:L - The attacker fully controls execbuf command layout and can set an undersized SVGA_3D_CMD_SURFACE_DMA header->size so the suffix pointer underflows into the prior command; no races, rare configs, or victim-dependent heap layout are required.\nPR:L - VMW_EXECBUF is registered with DRM_RENDER_ALLOW, so any local user with access to the DRM render node (typically membership in the render/video group on VMware guests) can reach vmw_cmd_dma without real root in the init namespace.\nUI:N - No victim interaction is required beyond the attacker opening the DRM device and submitting a malicious execbuf ioctl; exploitation does not depend on another user mounting filesystems or performing other actions.\nS:C - The bug is a TOCTOU on the device-visible SVGA command stream: verifier writes clobber already-checked fields (GMR id, surface id, DMA bounds) in the bounce buffer before submission to the VMware virtual GPU, bypassing guest/host isolation enforced by command authentication.\nC:H - Rewriting authenticated GMR/surface identifiers or inflating maximumOffset can authorize SVGA surface DMA reads (including SVGA3D_READ_HOST_VRAM) beyond validated guest buffer bounds, yielding arbitrary guest memory disclosure and plausible host VRAM reads via the virtual device backend.\nI:H - Clobbering verified command fields lets a later command rewrite another's GMR id, surface id, or DMA limit so the hypervisor executes unauthorized SVGA3D_WRITE_HOST_VRAM or guest GMR DMA, enabling arbitrary memory write and code-execution primitives typical of kernel heap corruption.\nA:H - Corrupting the bounce-buffer command stream before FIFO submission can panic the guest kernel (invalid SVGA commands/resources) and enables repeatable denial of service; memory corruption in the verifier path is independently rated High per kernel CVSS guidance."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c"],"versions":[{"version":"4e4ddd47774313accc86b233d6ca2c6a9037a671","lessThan":"eb20f418933bea53375843b27b4022c1810be63b","status":"affected","versionType":"git"},{"version":"4e4ddd47774313accc86b233d6ca2c6a9037a671","lessThan":"fcd1e56e7816b31a1050ccc67df722b20f6bb15d","status":"affected","versionType":"git"},{"version":"4e4ddd47774313accc86b233d6ca2c6a9037a671","lessThan":"a4a37080a5ac777b59306cfcdf854cc05d7604d4","status":"affected","versionType":"git"},{"version":"4e4ddd47774313accc86b233d6ca2c6a9037a671","lessThan":"036e16ada95389bdc30f41068af04c1d0872fad0","status":"affected","versionType":"git"},{"version":"4e4ddd47774313accc86b233d6ca2c6a9037a671","lessThan":"d5d7ada4e1296b00d89fe82b2ca850cc7809d6f7","status":"affected","versionType":"git"},{"version":"4e4ddd47774313accc86b233d6ca2c6a9037a671","lessThan":"7e40e6120fb232a10b543ffd994e5c6d8f3a2cc6","status":"affected","versionType":"git"},{"version":"4e4ddd47774313accc86b233d6ca2c6a9037a671","lessThan":"9759da60e38d7b9db44dc92713e4e0391883d221","status":"affected","versionType":"git"},{"version":"4e4ddd47774313accc86b233d6ca2c6a9037a671","lessThan":"f4f1db96bfd68b81053693ba53405b6f510ac16c","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c"],"versions":[{"version":"2.6.33","status":"affected"},{"version":"0","lessThan":"2.6.33","status":"unaffected","versionType":"semver"},{"version":"5.10.265","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.33","versionEndExcluding":"5.10.265"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.33","versionEndExcluding":"5.15.216"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.33","versionEndExcluding":"6.1.183"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.33","versionEndExcluding":"6.6.151"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.33","versionEndExcluding":"6.12.103"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.33","versionEndExcluding":"6.18.44"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.33","versionEndExcluding":"7.1.8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.33","versionEndExcluding":"7.2"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/eb20f418933bea53375843b27b4022c1810be63b"},{"url":"https://git.kernel.org/stable/c/fcd1e56e7816b31a1050ccc67df722b20f6bb15d"},{"url":"https://git.kernel.org/stable/c/a4a37080a5ac777b59306cfcdf854cc05d7604d4"},{"url":"https://git.kernel.org/stable/c/036e16ada95389bdc30f41068af04c1d0872fad0"},{"url":"https://git.kernel.org/stable/c/d5d7ada4e1296b00d89fe82b2ca850cc7809d6f7"},{"url":"https://git.kernel.org/stable/c/7e40e6120fb232a10b543ffd994e5c6d8f3a2cc6"},{"url":"https://git.kernel.org/stable/c/9759da60e38d7b9db44dc92713e4e0391883d221"},{"url":"https://git.kernel.org/stable/c/f4f1db96bfd68b81053693ba53405b6f510ac16c"}],"title":"drm/vmwgfx: bound DMA command body size against suffix pointer","x_generator":{"engine":"bippy-1.2.0"}}}}