CVE-2026-74443
Received Received - Intake

BaseFortify

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: bound DMA command body size against suffix pointer vmw_cmd_dma() locates the DMA suffix at (unsigned long) &cmd->body + header->size - sizeof(*suffix) without checking that header->size is large enough to contain both cmd->body and the suffix. An undersized header makes the suffix pointer underflow back into the previous command in the bounce buffer. The verifier later writes suffix->maximumOffset, clobbering verified fields of an already-relocated earlier command -- a TOCTOU on the device-visible command stream that lets one command rewrite another's GMR id, surface id, or other authenticated fields. Reject the command if the body is too small for the suffix to fit.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-74443
EUVD
EUVD-2026-59750

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability where a flaw in the vmwgfx driver allows a malicious command to underflow a pointer into a previous command in memory. This creates a time-of-check to time-of-use (TOCTOU) issue where one command can overwrite authenticated fields of another command, potentially altering GMR IDs or surface IDs.

Detection Guidance

This vulnerability is specific to the Linux kernel's vmwgfx driver and requires kernel-level inspection. Detection involves checking kernel logs for related errors or verifying the presence of the vulnerable code path. Commands like 'dmesg | grep vmwgfx' or inspecting kernel source for the affected function may help. No direct network detection commands are applicable.

Impact Analysis

An attacker with access to the system could exploit this to manipulate GPU commands, potentially causing system instability, unauthorized memory access, or privilege escalation. This could lead to data corruption or unauthorized control over GPU resources.

Mitigation Strategies

Apply the latest kernel updates from your Linux distribution to ensure the patched version is installed. If immediate patching is not possible, consider disabling the vmwgfx module if not in use by running 'modprobe -r vmwgfx'. Monitor kernel logs for suspicious activity post-update.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74443. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart