CVE-2026-74443
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
drm/vmwgfx: bound DMA command body size against suffix pointer
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: bound DMA command body size against suffix pointer vmw_cmd_dma() locates the DMA suffix at (unsigned long) &cmd->body + header->size - sizeof(*suffix) without checking that header->size is large enough to contain both cmd->body and the suffix. An undersized header makes the suffix pointer underflow back into the previous command in the bounce buffer. The verifier later writes suffix->maximumOffset, clobbering verified fields of an already-relocated earlier command -- a TOCTOU on the device-visible command stream that lets one command rewrite another's GMR id, surface id, or other authenticated fields. Reject the command if the body is too small for the suffix to fit.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 4e4ddd47774313accc86b233d6ca2c6a9037a671 | affected | git | eb20f418933bea53375843b27b4022c1810be63b | Unavailable | None listed |
| 4e4ddd47774313accc86b233d6ca2c6a9037a671 | affected | git | fcd1e56e7816b31a1050ccc67df722b20f6bb15d | Unavailable | None listed |
| 4e4ddd47774313accc86b233d6ca2c6a9037a671 | affected | git | a4a37080a5ac777b59306cfcdf854cc05d7604d4 | Unavailable | None listed |
| 4e4ddd47774313accc86b233d6ca2c6a9037a671 | affected | git | 036e16ada95389bdc30f41068af04c1d0872fad0 | Unavailable | None listed |
| 4e4ddd47774313accc86b233d6ca2c6a9037a671 | affected | git | d5d7ada4e1296b00d89fe82b2ca850cc7809d6f7 | Unavailable | None listed |
| 4e4ddd47774313accc86b233d6ca2c6a9037a671 | affected | git | 7e40e6120fb232a10b543ffd994e5c6d8f3a2cc6 | Unavailable | None listed |
| 4e4ddd47774313accc86b233d6ca2c6a9037a671 | affected | git | 9759da60e38d7b9db44dc92713e4e0391883d221 | Unavailable | None listed |
| 4e4ddd47774313accc86b233d6ca2c6a9037a671 | affected | git | f4f1db96bfd68b81053693ba53405b6f510ac16c | Unavailable | None listed |
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
affected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 2.6.33 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 0 | unaffected | semver | 2.6.33 | Unavailable | None listed |
| 5.10.265 | unaffected | semver | Unavailable | 5.10.* | None listed |
| 5.15.216 | unaffected | semver | Unavailable | 5.15.* | None listed |
| 6.1.183 | unaffected | semver | Unavailable | 6.1.* | None listed |
| 6.6.151 | unaffected | semver | Unavailable | 6.6.* | None listed |
| 6.12.103 | unaffected | semver | Unavailable | 6.12.* | None listed |
| 6.18.44 | unaffected | semver | Unavailable | 6.18.* | None listed |
| 7.1.8 | unaffected | semver | Unavailable | 7.1.* | None listed |
| 7.2 | unaffected | original_commit_for_fix | Unavailable | * | None listed |