CVE-2026-74443: drm/vmwgfx: bound DMA command body size against suffix pointer
In the Linux kernel, the following vulnerability has been resolved:
drm/vmwgfx: bound DMA command body size against suffix pointer
vmwcmddma() locates the DMA suffix at
(unsigned long) &cmd->body + header->size - sizeof(suffix)
without checking that header->size is large enough to contain both cmd->body and the suffix. An undersized header makes the suffix pointer underflow back into the previous command in the bounce buffer. The verifier later writes suffix->maximumOffset, clobbering verified fields of an already-relocated earlier command -- a TOCTOU on the device-visible command stream that lets one command rewrite another's GMR id, surface id, or other authenticated fields.
Reject the command if the body is too small for the suffix to fit.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In drm/vmwgfx, update vmw_cmd_dma() to reject DMA commands when the body/header size cannot accommodate both cmd->body and the DMA suffix pointer (i.e., prevent pointer underflow by ensuring the suffix fits within the header->size).
Linux kernel (drm/vmwgfx) vmw_cmd_dma() suffix/header size validation = Reject the command if cmd->body header->size is too small for the suffix to fit
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74443?
CVE-2026-74443 has a risk rating of 44, indicating it poses a significant potential threat to system security.
How do I fix CVE-2026-74443?
To fix CVE-2026-74443, update the Linux kernel to the latest version where the vulnerability has been resolved.
What software is affected by CVE-2026-74443?
CVE-2026-74443 affects the Linux kernel, particularly its drm/vmwgfx component.
What type of vulnerability is CVE-2026-74443?
CVE-2026-74443 is a memory safety vulnerability associated with DMA command processing in the Linux kernel.
When was CVE-2026-74443 published?
CVE-2026-74443 was published on August 15, 2026.