{"id":"CVE-2026-74444","summary":"drm/vmwgfx: validate DRAW_PRIMITIVES header size before division","details":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: validate DRAW_PRIMITIVES header size before division\n\nvmw_cmd_draw() computes\n\n\tmaxnum = (header-\u003esize - sizeof(cmd-\u003ebody)) / sizeof(*decl);\n\nwhere header-\u003esize is u32 and is taken straight from the user-supplied\ncommand stream.  When header-\u003esize is less than sizeof(cmd-\u003ebody) the\nunsigned subtraction wraps to nearly 4 GiB, producing a huge maxnum.\nAny user-controlled cmd-\u003ebody.numVertexDecls then passes the bound and\nthe loop dereferences decl[i] far past the end of the kernel command\nbounce buffer, producing an out-of-bounds read of kernel memory.\n\nReject undersized headers up front.","modified":"2026-08-21T03:30:21.029684704Z","published":"2026-08-15T12:26:51.443Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74444.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/112c6ff29a56f3a22db4d5af869697aa07035ad6"},{"type":"WEB","url":"https://git.kernel.org/stable/c/2666cddf0dd218aa9bd1f99db688d1b532eac21a"},{"type":"WEB","url":"https://git.kernel.org/stable/c/85891d174707d8bddcec7a888fb4e1d17def34f3"},{"type":"WEB","url":"https://git.kernel.org/stable/c/b89ca4bba820f79dde52af15ee139fe6e8bbc314"},{"type":"WEB","url":"https://git.kernel.org/stable/c/bef30317fcb4c838a37bceb2fc76256eb6b975c1"},{"type":"WEB","url":"https://git.kernel.org/stable/c/c77cf8edae2bd3a1599115301cc7c98d0c78e731"},{"type":"WEB","url":"https://git.kernel.org/stable/c/dc0be7662b7b0ce28cb5eea864737793ed7b9e70"},{"type":"WEB","url":"https://git.kernel.org/stable/c/fc0c02f510e41650df3479f96e257acf87d8a20a"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74444.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74444"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"7a73ba7469cbea631050094fd14f73acebb97cf9"},{"fixed":"b89ca4bba820f79dde52af15ee139fe6e8bbc314"},{"fixed":"bef30317fcb4c838a37bceb2fc76256eb6b975c1"},{"fixed":"112c6ff29a56f3a22db4d5af869697aa07035ad6"},{"fixed":"2666cddf0dd218aa9bd1f99db688d1b532eac21a"},{"fixed":"fc0c02f510e41650df3479f96e257acf87d8a20a"},{"fixed":"dc0be7662b7b0ce28cb5eea864737793ed7b9e70"},{"fixed":"c77cf8edae2bd3a1599115301cc7c98d0c78e731"},{"fixed":"85891d174707d8bddcec7a888fb4e1d17def34f3"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74444.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.33"},{"fixed":"5.10.265"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.216"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.183"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.151"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.103"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.44"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.1.8"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74444.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}