CVE-2026-74444

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the drm/vmwgfx component where the vmw cmd draw() function fails to properly validate the header->size variable before performing a division operation. Because header->size is a u32 value taken directly from a user-supplied command stream, providing a value smaller than sizeof(cmd->body) causes an unsigned subtraction wrap, resulting in an extremely large maxnum value. This allows a user-controlled cmd->body.numVertexDecls to bypass bounds checking, leading to an out-of-bounds read of kernel memory when the loop dereferences decl[i] beyond the kernel command bounce buffer.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.