CVE-2026-74444

Received Received - Intake

Integer Underflow in VMware Graphics Driver

Publication date: 2026-08-15

Last updated on: 2026-08-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate DRAW_PRIMITIVES header size before division vmw_cmd_draw() computes maxnum = (header->size - sizeof(cmd->body)) / sizeof(*decl); where header->size is u32 and is taken straight from the user-supplied command stream. When header->size is less than sizeof(cmd->body) the unsigned subtraction wraps to nearly 4 GiB, producing a huge maxnum. Any user-controlled cmd->body.numVertexDecls then passes the bound and the loop dereferences decl[i] far past the end of the kernel command bounce buffer, producing an out-of-bounds read of kernel memory. Reject undersized headers up front.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-19

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74444

EUVD

EUVD-2026-59751

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability where a user-supplied command header size is not properly validated. The code calculates a buffer size by subtracting the header size from a fixed value, but if the header size is too small, the result wraps around to a very large number. This causes the code to read far beyond the intended memory buffer, leading to an out-of-bounds read of kernel memory.

Detection Guidance

This vulnerability is specific to the Linux kernel's vmwgfx driver. Detection requires checking kernel logs for out-of-bounds read errors or crashes related to vmwgfx. Use commands like dmesg | grep vmwgfx or journalctl -k | grep vmwgfx to inspect kernel logs for suspicious activity.

Impact Analysis

An attacker with local access could exploit this to read sensitive kernel memory, potentially exposing passwords, encryption keys, or other confidential data. This could lead to privilege escalation or system compromise if combined with other vulnerabilities.

Compliance Impact

This vulnerability is a kernel memory read issue in the Linux graphics driver (vmwgfx) that could allow out-of-bounds memory access. It does not directly affect compliance with GDPR, HIPAA, or similar standards as it is not a data exposure or privacy violation by itself.

Mitigation Strategies

Update the Linux kernel to the latest patched version. If using a distribution kernel, apply vendor-provided updates immediately. Disable the vmwgfx module if not needed with modprobe -r vmwgfx. Monitor for crashes or unusual behavior in graphics-related processes.

Hi! I’m here to help you understand CVE-2026-74444. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70