Log in Start free

Vulnerability · Published Aug 15, 2026 · Assigned by Linux

CVE-2026-74443drm/vmwgfx: bound DMA command body size against suffix pointer

High 8.8

In plain English

A high-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.1%top 97.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: bound DMA command body size against suffix pointer vmw_cmd_dma() locates the DMA suffix at (unsigned long) &cmd->body + header->size - sizeof(*suffix) without checking that header->size is large enough to contain both cmd->body and the suffix. An undersized header makes the suffix pointer underflow back into the previous command in the bounce buffer. The verifier later writes suffix->maximumOffset, clobbering verified fields of an already-relocated earlier command -- a TOCTOU on the device-visible command stream that lets one command rewrite another's GMR id, surface id, or other authenticated fields. Reject the command if the body is too small for the suffix to fit.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux6.1.187-1DEBIAN-CVE-2026-74443
Debian:13linux6.12.105-1DEBIAN-CVE-2026-74443
Debian:14linux7.1.8-1DEBIAN-CVE-2026-74443
Debian:12linux-6.126.12.107-1~deb12u1DEBIAN-CVE-2026-74443
Ubuntu:22.04:LTSlinux5.15.0-198.208UBUNTU-CVE-2026-74443
Ubuntu:24.04:LTSlinuxno fix listedUBUNTU-CVE-2026-74443
Ubuntu:26.04:LTSlinux7.0.0-42.42USN-8959-1
Ubuntu:26.04:LTSlinux7.0.0-42.42UBUNTU-CVE-2026-74443
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2026-74443
Ubuntu:22.04:LTSlinux-aws5.15.0-1117.124UBUNTU-CVE-2026-74443
Ubuntu:24.04:LTSlinux-awsno fix listedUBUNTU-CVE-2026-74443
Ubuntu:26.04:LTSlinux-aws7.0.0-1016.17UBUNTU-CVE-2026-74443
Ubuntu:26.04:LTSlinux-aws7.0.0-1016.17USN-8959-1
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2026-74443
Ubuntu:24.04:LTSlinux-aws-6.14no fix listedUBUNTU-CVE-2026-74443
Ubuntu:24.04:LTSlinux-aws-6.17no fix listedUBUNTU-CVE-2026-74443
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2026-74443
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2026-74443
Ubuntu:22.04:LTSlinux-aws-6.8no fix listedUBUNTU-CVE-2026-74443
Ubuntu:24.04:LTSlinux-aws-7.0no fix listedUBUNTU-CVE-2026-74443
Ubuntu:22.04:LTSlinux-azure5.15.0-1123.132UBUNTU-CVE-2026-74443
Ubuntu:24.04:LTSlinux-azureno fix listedUBUNTU-CVE-2026-74443
Ubuntu:26.04:LTSlinux-azureno fix listedUBUNTU-CVE-2026-74443
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2026-74443
Ubuntu:24.04:LTSlinux-azure-6.11no fix listedUBUNTU-CVE-2026-74443
Ubuntu:24.04:LTSlinux-azure-6.14no fix listedUBUNTU-CVE-2026-74443
Ubuntu:24.04:LTSlinux-azure-6.17no fix listedUBUNTU-CVE-2026-74443
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2026-74443
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2026-74443
Ubuntu:22.04:LTSlinux-azure-6.8no fix listedUBUNTU-CVE-2026-74443
Ubuntu:24.04:LTSlinux-azure-7.0no fix listedUBUNTU-CVE-2026-74443
Ubuntu:22.04:LTSlinux-azure-fde5.15.0-1122.131UBUNTU-CVE-2026-74443
Ubuntu:24.04:LTSlinux-azure-fdeno fix listedUBUNTU-CVE-2026-74443
Ubuntu:26.04:LTSlinux-azure-fdeno fix listedUBUNTU-CVE-2026-74443
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2026-74443
Ubuntu:24.04:LTSlinux-azure-fde-6.14no fix listedUBUNTU-CVE-2026-74443
Ubuntu:24.04:LTSlinux-azure-fde-6.17no fix listedUBUNTU-CVE-2026-74443
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2026-74443
Ubuntu:22.04:LTSlinux-azure-fde-6.8no fix listedUBUNTU-CVE-2026-74443
Ubuntu:24.04:LTSlinux-azure-fde-7.0no fix listedUBUNTU-CVE-2026-74443
Ubuntu:24.04:LTSlinux-azure-nvidiano fix listedUBUNTU-CVE-2026-74443
Ubuntu:24.04:LTSlinux-azure-nvidia-6.14no fix listedUBUNTU-CVE-2026-74443
Ubuntu:22.04:LTSlinux-gcp5.15.0-1118.128UBUNTU-CVE-2026-74443
Ubuntu:24.04:LTSlinux-gcpno fix listedUBUNTU-CVE-2026-74443
Ubuntu:26.04:LTSlinux-gcp7.0.0-1016.18USN-8959-1
Ubuntu:26.04:LTSlinux-gcp7.0.0-1016.18UBUNTU-CVE-2026-74443
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2026-74443
Ubuntu:24.04:LTSlinux-gcp-6.11no fix listedUBUNTU-CVE-2026-74443
Ubuntu:24.04:LTSlinux-gcp-6.14no fix listedUBUNTU-CVE-2026-74443
Ubuntu:24.04:LTSlinux-gcp-6.17no fix listedUBUNTU-CVE-2026-74443
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2026-74443
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2026-74443
Ubuntu:22.04:LTSlinux-gcp-6.8no fix listedUBUNTU-CVE-2026-74443
Ubuntu:24.04:LTSlinux-gcp-7.0no fix listedUBUNTU-CVE-2026-74443
Ubuntu:22.04:LTSlinux-gke5.15.0-1113.119UBUNTU-CVE-2026-74443
Ubuntu:24.04:LTSlinux-gkeno fix listedUBUNTU-CVE-2026-74443
Ubuntu:26.04:LTSlinux-gkeno fix listedUBUNTU-CVE-2026-74443
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1100.108UBUNTU-CVE-2026-74443
Ubuntu:24.04:LTSlinux-gkeopno fix listedUBUNTU-CVE-2026-74443
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2026-74443
Ubuntu:24.04:LTSlinux-hwe-6.11no fix listedUBUNTU-CVE-2026-74443
Ubuntu:24.04:LTSlinux-hwe-6.14no fix listedUBUNTU-CVE-2026-74443
Ubuntu:24.04:LTSlinux-hwe-6.17no fix listedUBUNTU-CVE-2026-74443
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2026-74443
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2026-74443
Ubuntu:22.04:LTSlinux-hwe-6.8no fix listedUBUNTU-CVE-2026-74443
Ubuntu:24.04:LTSlinux-hwe-7.07.0.0-42.42~24.04.1UBUNTU-CVE-2026-74443
Ubuntu:24.04:LTSlinux-hwe-7.07.0.0-42.42~24.04.1USN-8959-1
Ubuntu:22.04:LTSlinux-ibm5.15.0-1111.115UBUNTU-CVE-2026-74443
Ubuntu:24.04:LTSlinux-ibmno fix listedUBUNTU-CVE-2026-74443
Ubuntu:26.04:LTSlinux-ibm7.0.0-1017.17USN-8959-1
Ubuntu:26.04:LTSlinux-ibm7.0.0-1017.17UBUNTU-CVE-2026-74443
Ubuntu:22.04:LTSlinux-ibm-6.8no fix listedUBUNTU-CVE-2026-74443
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2026-74443
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1112.118UBUNTU-CVE-2026-74443
Ubuntu:22.04:LTSlinux-kvm5.15.0-1109.114UBUNTU-CVE-2026-74443
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-195.205UBUNTU-CVE-2026-74443
Ubuntu:24.04:LTSlinux-lowlatencyno fix listedUBUNTU-CVE-2026-74443
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2026-74443
Ubuntu:24.04:LTSlinux-lowlatency-hwe-6.11no fix listedUBUNTU-CVE-2026-74443
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2026-74443
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2026-74443
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.8no fix listedUBUNTU-CVE-2026-74443
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1112.113UBUNTU-CVE-2026-74443
Ubuntu:24.04:LTSlinux-nvidiano fix listedUBUNTU-CVE-2026-74443
Ubuntu:26.04:LTSlinux-nvidiano fix listedUBUNTU-CVE-2026-74443
Ubuntu:24.04:LTSlinux-nvidia-6.11no fix listedUBUNTU-CVE-2026-74443
Ubuntu:24.04:LTSlinux-nvidia-6.17no fix listedUBUNTU-CVE-2026-74443
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2026-74443
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2026-74443
Ubuntu:22.04:LTSlinux-nvidia-6.8no fix listedUBUNTU-CVE-2026-74443
Ubuntu:24.04:LTSlinux-nvidia-7.0no fix listedUBUNTU-CVE-2026-74443
Ubuntu:26.04:LTSlinux-nvidia-bosno fix listedUBUNTU-CVE-2026-74443
Ubuntu:24.04:LTSlinux-nvidia-lowlatencyno fix listedUBUNTU-CVE-2026-74443
Ubuntu:22.04:LTSlinux-nvidia-tegra5.15.0-1070.72UBUNTU-CVE-2026-74443
Ubuntu:24.04:LTSlinux-nvidia-tegra6.8.0-1036.39UBUNTU-CVE-2026-74443
Ubuntu:22.04:LTSlinux-nvidia-tegra-igx5.15.0-1059.59UBUNTU-CVE-2026-74443
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2026-74443
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2026-74443
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2026-74443
Ubuntu:24.04:LTSlinux-oem-6.11no fix listedUBUNTU-CVE-2026-74443
Ubuntu:24.04:LTSlinux-oem-6.14no fix listedUBUNTU-CVE-2026-74443
Ubuntu:24.04:LTSlinux-oem-6.17no fix listedUBUNTU-CVE-2026-74443
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2026-74443
Ubuntu:24.04:LTSlinux-oem-6.8no fix listedUBUNTU-CVE-2026-74443
Ubuntu:26.04:LTSlinux-oem-7.07.0.0-1017.17USN-8960-1
Ubuntu:26.04:LTSlinux-oem-7.07.0.0-1017.17UBUNTU-CVE-2026-74443
Ubuntu:22.04:LTSlinux-oracle5.15.0-1114.120UBUNTU-CVE-2026-74443
Ubuntu:24.04:LTSlinux-oracleno fix listedUBUNTU-CVE-2026-74443
Ubuntu:26.04:LTSlinux-oracle7.0.0-1015.16UBUNTU-CVE-2026-74443
Ubuntu:26.04:LTSlinux-oracle7.0.0-1015.16USN-8959-1
Ubuntu:24.04:LTSlinux-oracle-6.14no fix listedUBUNTU-CVE-2026-74443
Ubuntu:24.04:LTSlinux-oracle-6.17no fix listedUBUNTU-CVE-2026-74443
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2026-74443
Ubuntu:22.04:LTSlinux-oracle-6.8no fix listedUBUNTU-CVE-2026-74443
Ubuntu:24.04:LTSlinux-oracle-7.0no fix listedUBUNTU-CVE-2026-74443
Ubuntu:22.04:LTSlinux-raspino fix listedUBUNTU-CVE-2026-74443
Ubuntu:24.04:LTSlinux-raspino fix listedUBUNTU-CVE-2026-74443
Ubuntu:26.04:LTSlinux-raspino fix listedUBUNTU-CVE-2026-74443
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2026-74443
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2026-74443
Ubuntu:24.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2026-74443
Ubuntu:26.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2026-74443
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2026-74443
Ubuntu:24.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2026-74443
Ubuntu:26.04:LTSlinux-riscv7.0.0-42.42.1UBUNTU-CVE-2026-74443
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2026-74443
Ubuntu:24.04:LTSlinux-riscv-6.14no fix listedUBUNTU-CVE-2026-74443
Ubuntu:24.04:LTSlinux-riscv-6.17no fix listedUBUNTU-CVE-2026-74443
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2026-74443
Ubuntu:22.04:LTSlinux-riscv-6.8no fix listedUBUNTU-CVE-2026-74443
Ubuntu:24.04:LTSlinux-riscv-7.07.0.0-42.42.1~24.04.1UBUNTU-CVE-2026-74443
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2026-74443
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2026-74443
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2026-74443
Ubuntu:24.04:LTSlinux-vmwareno fix listedUBUNTU-CVE-2026-74443
Ubuntu:24.04:LTSlinux-xilinxno fix listedUBUNTU-CVE-2026-74443
Ubuntu:22.04:LTSlinux-xilinx-zynqmp5.15.0-1080.84UBUNTU-CVE-2026-74443

Affected products (as reported)

VendorProductVersions
Linux Linux 4e4ddd47774313accc86b233d6ca2c6a9037a671 – before eb20f418933bea53375843b27b4022c1810be63b4e4ddd47774313accc86b233d6ca2c6a9037a671 – before fcd1e56e7816b31a1050ccc67df722b20f6bb15d4e4ddd47774313accc86b233d6ca2c6a9037a671 – before a4a37080a5ac777b59306cfcdf854cc05d7604d44e4ddd47774313accc86b233d6ca2c6a9037a671 – before 036e16ada95389bdc30f41068af04c1d0872fad04e4ddd47774313accc86b233d6ca2c6a9037a671 – before d5d7ada4e1296b00d89fe82b2ca850cc7809d6f74e4ddd47774313accc86b233d6ca2c6a9037a671 – before 7e40e6120fb232a10b543ffd994e5c6d8f3a2cc64e4ddd47774313accc86b233d6ca2c6a9037a671 – before 9759da60e38d7b9db44dc92713e4e0391883d2214e4ddd47774313accc86b233d6ca2c6a9037a671 – before f4f1db96bfd68b81053693ba53405b6f510ac16c
Linux Linux 2.6.33

References