{"id":"CVE-2026-74444","revision":"54e13db3015748e9a25ee3bb65465825","records":[{"revision":"54e13db3015748e9a25ee3bb65465825","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-74444","aliases":[],"title":"drm/vmwgfx: validate DRAW_PRIMITIVES header size before division","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: validate DRAW_PRIMITIVES header size before division\n\nvmw_cmd_draw() computes\n\n\tmaxnum = (header->size - sizeof(cmd->body)) / sizeof(*decl);\n\nwhere header->size is u32 and is taken straight from the user-supplied\ncommand stream.  When header->size is less than sizeof(cmd->body) the\nunsigned subtraction wraps to nearly 4 GiB, producing a huge maxnum.\nAny user-controlled cmd->body.numVertexDecls then passes the bound and\nthe loop dereferences decl[i] far past the end of the kernel command\nbounce buffer, producing an out-of-bounds read of kernel memory.\n\nReject undersized headers up front.","state":0,"publishedAt":"2026-08-15T12:26:51.443+00:00","modifiedAt":"2026-10-16T19:05:45.89+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"7a73ba7469cbea631050094fd14f73acebb97cf9\",\n                            \"lessThan\": \"b89ca4bba820f79dde52af15ee139fe6e8bbc314\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7a73ba7469cbea631050094fd14f73acebb97cf9\",\n                            \"lessThan\": \"bef30317fcb4c838a37bceb2fc76256eb6b975c1\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7a73ba7469cbea631050094fd14f73acebb97cf9\",\n                            \"lessThan\": \"112c6ff29a56f3a22db4d5af869697aa07035ad6\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7a73ba7469cbea631050094fd14f73acebb97cf9\",\n                            \"lessThan\": \"2666cddf0dd218aa9bd1f99db688d1b532eac21a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7a73ba7469cbea631050094fd14f73acebb97cf9\",\n                            \"lessThan\": \"fc0c02f510e41650df3479f96e257acf87d8a20a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7a73ba7469cbea631050094fd14f73acebb97cf9\",\n                            \"lessThan\": \"dc0be7662b7b0ce28cb5eea864737793ed7b9e70\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7a73ba7469cbea631050094fd14f73acebb97cf9\",\n                            \"lessThan\": \"c77cf8edae2bd3a1599115301cc7c98d0c78e731\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7a73ba7469cbea631050094fd14f73acebb97cf9\",\n                            \"lessThan\": \"85891d174707d8bddcec7a888fb4e1d17def34f3\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"2.6.33\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"2.6.33\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.265\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.216\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.183\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.151\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.103\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.44\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1.8\",\n                            \"lessThanOrEqual\": \"7.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/b89ca4bba820f79dde52af15ee139fe6e8bbc314","https://git.kernel.org/stable/c/bef30317fcb4c838a37bceb2fc76256eb6b975c1","https://git.kernel.org/stable/c/112c6ff29a56f3a22db4d5af869697aa07035ad6","https://git.kernel.org/stable/c/2666cddf0dd218aa9bd1f99db688d1b532eac21a","https://git.kernel.org/stable/c/fc0c02f510e41650df3479f96e257acf87d8a20a","https://git.kernel.org/stable/c/dc0be7662b7b0ce28cb5eea864737793ed7b9e70","https://git.kernel.org/stable/c/c77cf8edae2bd3a1599115301cc7c98d0c78e731","https://git.kernel.org/stable/c/85891d174707d8bddcec7a888fb4e1d17def34f3"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-74444","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-74444","identifiers":["CVE-2026-74444"]},"retained":false,"historicalAffected":[]}],"coverage":[]}