CVE-2026-74444
Description
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate DRAW_PRIMITIVES header size before division vmw_cmd_draw() computes maxnum = (header->size - sizeof(cmd->body)) / sizeof(*decl); where header->size is u32 and is taken straight from the user-supplied command stream. When header->size is less than sizeof(cmd->body) the unsigned subtraction wraps to nearly 4 GiB, producing a huge maxnum. Any user-controlled cmd->body.numVertexDecls then passes the bound and the loop dereferences decl[i] far past the end of the kernel command bounce buffer, producing an out-of-bounds read of kernel memory. Reject undersized headers up front.
How to fix
- Linux Linuxb89ca4bba820f79dde52af15ee139fe6e8bbc314, bef30317fcb4c838a37bceb2fc76256eb6b975c1, 112c6ff29a56f3a22db4d5af869697aa07035ad6, 2666cddf0dd218aa9bd1f99db688d1b532eac21a, fc0c02f510e41650df3479f96e257acf87d8a20a, dc0be7662b7b0ce28cb5eea864737793ed7b9e70, c77cf8edae2bd3a1599115301cc7c98d0c78e731, 85891d174707d8bddcec7a888fb4e1d17def34f3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 7a73ba7469cbea631050094fd14f73acebb97cf9 ≤ v < b89ca4bba820f79dde52af15ee139fe6e8bbc314, 7a73ba7469cbea631050094fd14f73acebb97cf9 ≤ v < bef30317fcb4c838a37bceb2fc76256eb6b975c1, 7a73ba7469cbea631050094fd14f73acebb97cf9 ≤ v < 112c6ff29a56f3a22db4d5af869697aa07035ad6, 7a73ba7469cbea631050094fd14f73acebb97cf9 ≤ v < 2666cddf0dd218aa9bd1f99db688d1b532eac21a, 7a73ba7469cbea631050094fd14f73acebb97cf9 ≤ v < fc0c02f510e41650df3479f96e257acf87d8a20a, 7a73ba7469cbea631050094fd14f73acebb97cf9 ≤ v < dc0be7662b7b0ce28cb5eea864737793ed7b9e70, 7a73ba7469cbea631050094fd14f73acebb97cf9 ≤ v < c77cf8edae2bd3a1599115301cc7c98d0c78e731, 7a73ba7469cbea631050094fd14f73acebb97cf9 ≤ v < 85891d174707d8bddcec7a888fb4e1d17def34f3, 2.6.33 | b89ca4bba820f79dde52af15ee139fe6e8bbc314, bef30317fcb4c838a37bceb2fc76256eb6b975c1, 112c6ff29a56f3a22db4d5af869697aa07035ad6, 2666cddf0dd218aa9bd1f99db688d1b532eac21a, fc0c02f510e41650df3479f96e257acf87d8a20a, dc0be7662b7b0ce28cb5eea864737793ed7b9e70, c77cf8edae2bd3a1599115301cc7c98d0c78e731, 85891d174707d8bddcec7a888fb4e1d17def34f3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.