CVE-2026-74444: drm/vmwgfx: validate DRAW_PRIMITIVES header size before division
In the Linux kernel, the following vulnerability has been resolved:
drm/vmwgfx: validate DRAWPRIMITIVES header size before division
vmwcmddraw() computes
maxnum = (header->size - sizeof(cmd->body)) / sizeof(decl);
where header->size is u32 and is taken straight from the user-supplied command stream. When header->size is less than sizeof(cmd->body) the unsigned subtraction wraps to nearly 4 GiB, producing a huge maxnum. Any user-controlled cmd->body.numVertexDecls then passes the bound and the loop dereferences decl[i] far past the end of the kernel command bounce buffer, producing an out-of-bounds read of kernel memory.
Reject undersized headers up front.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74444?
CVE-2026-74444 has a risk score of 62, indicating a moderate level of severity.
How do I fix CVE-2026-74444?
To mitigate CVE-2026-74444, ensure that your Linux kernel is updated to the latest version where this vulnerability has been patched.
Which versions of the Linux kernel are affected by CVE-2026-74444?
CVE-2026-74444 affects certain versions of the Linux kernel prior to the fix released on August 15, 2026.
What type of vulnerability is CVE-2026-74444?
CVE-2026-74444 is a validation vulnerability related to the drawing primitives header size in the drm/vmwgfx component of the Linux kernel.
How can CVE-2026-74444 impact system security?
CVE-2026-74444 may allow an attacker to exploit the vulnerability through crafted user commands, potentially leading to unexpected behavior or system compromise.