CVE-2026-74444
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
In the Linux kernel, the vmwgfx driver has a vulnerability where the DRAW_PRIMITIVES header size is not validated before division. A small header size causes unsigned subtraction to wrap, leading to an out-of-bounds read. The fix rejects undersized headers.
Risk Assessment
A local attacker could read kernel memory out of bounds, potentially leading to information disclosure or system crash.
Recommendation
Apply the Linux kernel update containing the fix (commit from the vmwgfx series).
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate DRAW_PRIMITIVES header size before division vmw_cmd_draw() computes maxnum = (header->size - sizeof(cmd->body)) / sizeof(*decl); where header->size is u32 and is taken straight from the user-supplied command stream. When header->size is less than sizeof(cmd->body) the unsigned subtraction wraps to nearly 4 GiB, producing a huge maxnum. Any user-controlled cmd->body.numVertexDecls then passes the bound and the loop dereferences decl[i] far past the end of the kernel command bounce buffer, producing an out-of-bounds read of kernel memory. Reject undersized headers up front.