CVE-2026-74443
In the Linux kernel, the following vulnerability has been resolved:
drm/vmwgfx: bound DMA command body size against suffix pointer
vmw_cmd_dma() locates the DMA suffix at
(unsigned long) &cmd->body + header->size - sizeof(*suffix)
without checking that header->size is large enough to contain both
cmd->body and the suffix. An undersized header makes the suffix
pointer underflow back into the previous command in the bounce
buffer. The verifier later writes suffix->maximumOffset, clobbering
verified fields of an already-relocated earlier command -- a TOCTOU
on the device-visible command stream that lets one command rewrite
another's GMR id, surface id, or other authenticated fields.
Reject the command if the body is too small for the suffix to fit.
CSIRTS triage
- What
- The drm/vmwgfx graphics driver fails to validate DMA command body size against the suffix pointer, allowing buffer overread.
- Who is affected
- Systems using VMware SVGA graphics virtualization (vmwgfx driver).
- Urgency
- High severity (CVSS 7.8); no known exploitation but DMA validation bypass can leak kernel memory or cause crash.
- Action
- Apply kernel patch that bounds DMA command body size validation against the suffix pointer in vmwgfx.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch CVE-2026-74443
Get an email if CVE-2026-74443 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.13% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 3% of all EPSS-scored CVEs.
Advisory coverage (3)
- unknownDSA-6466-1 linux - security updatedebian · 2026-08-25
- highCVE-2026-74443: In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: bound DMA comm…nvd · 2026-08-15
- highCVE-2026-74443: drm/vmwgfx: bound DMA command body size against suffix pointermsrc · 2026-08-11
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-74443)